r/Passkeys

Some of you have been asking for passkeys. We’re excited to announce you can now use them to log in to your Fidelity account on our desktop and mobile websites.

We are working on rolling out passkeys for the Fidelity Investments Mobile App, Fidelity Trader+ and ATP in the future so stay tuned.

What are passkeys?

Passkeys use a face scan, your fingerprint, device pin, or hardware security key to log in instead of passwords. This helps you sign in faster while protecting you against scams, like phishing.

Why use a passkey?

No typing a password, no waiting for a text with a security code, and passkeys only work with our real website. They’re a simple and secure way to sign in.

How do I set up a passkey?

It’s easy:

1. Log in to your account
2. Select the Security section of your Profile Menu
3. Select ”Set up” on Passkey in the Multi-factor authentication card
4. Verify your identity with face scan, fingerprint, a device pin, or a hardware key

That's it.

From then on, you can sign in without remembering or typing a password. Just log in to your account the same way you unlock your device.

And as always, let us know if you have any feedback on this update and what you’d like to see in the future.

https://preview.redd.it/w3z5t0q67cuh1.png?width=1350&format=png&auto=webp&s=c0536547f90ecc3e67f41f8f731fbec1e93293c1

I’ll be the first to admit that I’m an old man about this (even though I’m just shy of 30) but this insistence on passkeys just seems superfluous. I have two devices, a laptop and an iPhone, and both have my Google passwords saved in the password managers. I’m just an average everyday normal mfer and I’m not worried about someone hacking my Gmail. But even when I turn the “avoid password when possible” or whatever option off, I’m still getting prompted to scan a QR code every time I try to log in. Like yes let me just get my other phone to scan a QR code from my phone screen instead of auto-filling my password, cause it’s 2026 and I have an iPhone for each pocket of my pants.

Maybe for some it’s more efficient, but this doesn’t seem like a helpful rollout for the most part. It’s just annoying extra stuff to do every time you log in. Is it to cover themselves legally in some way? What’s the actual motive?

https://preview.redd.it/kxc73dir0auh1.png?width=1088&format=png&auto=webp&s=274a993167b50f94a4e644450667cab85d72d092

I don't understand what I'm supposed to do when I see this, my 1Password is on my computer I don't have my phone with me. Passkeys implementation honestly feels so unready, why are they pushing this so hard when it's not well supported everywhere even in the most popular browser.

I am switching where possible to passkeys. I am finding the the variation of implementation at retailers annoying. Not the look and feel which I expect to be different but the actual passkey storage. I have 3 hardware devices that store passkeys. They are Yubikeys.

On most sites I have found they seem to implement passkeys through Windows security. I have not tested a Mac or Linux systems yet. The sites that use Windows security have no problem dealing with multiple passkeys using the same user, browser, and OS.

Some of the sites automaticly name the stored keys with no aliasing or renaming available. At those retailers I end up with 3 keys with the same name. confusing should I need to remove one because the security device is lost or stolen. The simple way out will be deleting them all and recreate them but it will be more time consuming.

I have also found a few sites tha seem to have built the own interface to store the passkey. Some of these sites do not allow me to store the key where I want to and in the worst case they assume there is only one passkey per user, browser, and OS combination which is quite frustrating.

Then trying to get the first tier help folks to understand the problem and escalate the issue up the support chain is a whole other frustration issue.

I know I'm a technophile outlier by having multiple hardware security devices but has anyone else had these issues? Are there problems I have yes to run into?

Passkeys - still new to me. But if I have a shared computer in my house, I should NOT use Passkeys? Won't this potentially give people access to my stuff? Or is a password still required PLUS a Passkey?

I'm lost here.

Whelp, I just figured out why after scanning the QR Code with my iPhone X the popup on Chrome stayed stuck at Connecting when it was working fine last night. Google updated Chrome with Version 155.0.8059.40 and did something with the WebAuthn and that locks out people with older iOS versions so all their passkeys are useless now on the browser. The passkeys do not work anymore. I've tried multiple sites and they all just stay stuck at "Connecting" after you scan the QR Code when last night before the update the passkeys were working fine.

I was able to confirm this by using the Chrome mobile browser on my iPhone X and I was able to log in perfectly fine with the same passkeys. I also tried the Microsoft Edge browser on the same PC that I have Chrome on and it was also able to accept the passkey.

I'm looking to get started in improving my digital security, but I have a couple doubts about which provider to use. I already know how passkeys theoretically work but...

So Passkeys get saved on the device, and you unlock different apps, websites or services with your biometrics (FaceID, TouchID) and a PIN.

My question is, if a thief forces me to give them my PIN or if someone gets my PIN in any other way, how do my passkeys stay protected?

What is the difference between Google and Bitwarden in this aspect? Also, can I use passkeys for email accounts? Should I use Proton Mail for creating an account in Bitwarden or should I just use a gmail account (For example)? Thanks in advance

I'm still reading some inconclusive things, on potentially needing some other authentication method.

Disclosure: this comes from a project I built (Auth Your Agent; the client side is MIT and free).

I let an AI agent run errands on websites for me. Getting it signed in was never the worrying part. What worried me was what it does once it's in. So anything that costs money or can't be undone waits for me to confirm with a passkey on my phone.

Some choices I'd like opinions on:

• A password can never approve these. It has to be a fresh passkey assertion, and each approval works once.
• The shop writes the text I approve ("Pay $45.00 at Lamp Shop for Brass lighthouse lamp"), not the agent, so the agent can't describe one purchase and make another.
• I approve a sign-in once for a period I choose, from an hour to 30 days, but payments ask every time.
• For a scheduled run (say, posting at 3 a.m.), the agent sends a plan first, and one passkey approval covers the steps I tick, each with its exact text. That approval needs the passkey. Signing in with Google can't approve a plan, because it would approve every step.

Here's a real agent checkout on a demo shop, 24 seconds from Buy to Paid (31-second video): https://authyouragent.com/static/video/demo-shop-checkout.mp4

Two things I'm unsure about. Is a passkey prompt on every payment too much friction? And if you have synced passkeys on several devices, should any of them be able to approve, or only the phone that registered?