Adding a Passkey implicitly enables 2FA which effectively disables password-based login and unexpectedly makes account recovery impossible

After adding a Passkey, users can login using the Passkey just fine. But when they attempt to login using their password again (*) they unexpectedly see a 2FA prompt which asks them to provide their Passkey as a second factor. This seems to hit users by surprise because they just clicked "Add Passkey". They did not click and were not told either that 1) they would no longer be able to login via password anymore and 2) 2FA would be enabled and 3) they absolutely have to save their 2FA backup...

Read more

Читать далее...