Passwords have problems, but passkeys have more

David Heinemeier Hansson writes that passkeys were not worth their complexity for ONCE/Campfire, so the team dropped them and is sticking with passwords and email. He says the team had built its early authentication system around passkeys, which was complicated on the backend, but the user experience was poor and the feature was ripped out. He argues passkeys tie accounts to a platform in ways users don't notice, so a passkey stored on an iPhone or Windows device can leave a user locked out on another device. He concedes passwords have problems, but says the planned approach is to encourage opt-in 2FA and password managers without requiring them.