Finally, a dialog box allows the creation of a password on a security key.
The duel dialogs in this example are by no means unique to macOS.
Too many cooks in the kitchen
“Most try to direct you to a vendor’s sync key option and don’t specify how you can use other things,” Brown noted. “Chrome, Apple, Windows all try to force you to use their default synced passwords, and you have to click through the prompts to use alternatives.”
Bruce Davie, another software engineer with expertise in authentication, agreed, writing in a October article that the current implementation of access keys “seems to have failed the ‘make it easier for users’ test, which I think is the whole point of access keys.”
In April, Son Nguyen Kim, product manager of the free program Proton pass password manager, wrote an article titled Big Tech Access Key Implementations Are a Trap. In it, he complained that credential implementations to date lock users into the platform on which they created the credentials.
“If you use Google Chrome as your browser on a Mac, it uses the Apple Keychain feature to store your passwords,” he wrote. “This means you can’t sync your passwords with your Chrome profile on other devices.” In an email last month, Kim said users can now skip this option and choose to store their access keys in Chrome. Even then, “passkeys created in Chrome on Mac do not sync with Chrome on iPhone, so the user cannot do this.” use it seamlessly on Chrome on their iPhone.
Other posts reciting similar complaints are here And here.
In short, there are too many cooks in the kitchen, and everyone thinks they know the right way to make the pie.
I’ve put these and other criticisms to the test over the past four months. I used them on a real heterogeneous environment which includes a MacBook Air, a Lenovo X1 ThinkPad, an iPhone and a Pixel running Firefox, Chrome, Edge, Safari, and on the phones, a large number of applications, including those for LinkedIn , PayPal, eBay, Kayak, Gmail, Amazon and Uber. My goal has been to understand how well password authentication works in the long term, especially for cross-platform users.