Passkeys supported sites and apps

[ipedro]

Sign In with Apple was the precursor for Passkeys. Given the way it's been engineered, it looks like all of those that have added support for Sign In with Apple will work from the get go with Passkeys – if not directly, then through Sign In With Apple which will look and act the same when logging in with an Apple device. Outliers that refused to jump on the bandwagon will more likely join Passkeys since it's endorsed by Google and Microsoft via the FIDO Alliance.

Please edit this Wiki to add websites and apps that support or have announced support for Passkeys:

Supports Passkeys:

1. PayPal
2. GoDaddy
3. eBay
4. Kayak
5. Shopify
6. Google
7. Github
8. Nintendo

 

[tim_apple]

eBay web site supports passkeys. I don’t know since when, but it prompted me to create a passkey yesterday, although it doesn’t seem to work with the app yet, so don’t delete your password just yet.

 

[zakarhino]

When I signed in with PayPal a couple weeks ago on my iPhone it gave me the option to create a PassKey for login on my iOS device. I selected the option to test it out and it works. The passkey appears in my Settings app too.

 

[tim_apple]

When I signed in with PayPal a couple weeks ago on my iPhone it gave me the option to create a PassKey for login on my iOS device. I selected the option to test it out and it works. The passkey appears in my Settings app too..

I tried just now and neither the app nor the website prompted me to create a passkey

 

[tim_apple]

Weird. eBay won’t ask for my passkey anymore. Maybe they were just testing it.

 

[MacGizmo]

Individual websites have to be coded to use Passkeys... which hardly any are. I suspect this will take years before it is widely implemented across the web (beyond Apple-centric sites).

 

[ipedro]

GoDaddy has rolled out Passkey support.

 

[ipedro]

Google has support for Passkeys but it’s still a little janky. It thinks it’s a removable key and sometimes asks you to “remove the key and plug it back in”.

 

[ipedro]

eBay officially supports Passkeys

 

[Shin-Ra]

True passkey support replaces both the password and any second-step/multi-factor authentication steps when logging in. Google’s current security key support is a form of 2-step verification that’s only presented after entering a password.

Webauthn credentials and the browser/OS trigger mechanisms are common to passkeys and FIDO 2SV security keys so the same or similar UI may pop when using both.

When Google publicly launches passkey support for Google accounts, after creating a passkey you won’t need to enter a password and the wording during the login flow should be much clearer you’re using a passkey.


I don’t have a GoDaddy account to test but ‘Email me a secure code’ isn’t consistent with passkeys.


The eBay login looks like the support they’ve had for an earlier form of password-less sign-in Apple’s supported since Safari 14 in 2020. It’s similar to passkeys in login flow, uses Webauthn and Touch/Face ID but credentials aren’t stored long-term or shared between devices with iCloud Keychain.

 

[Shin-Ra]

Best Buy’s another site with Biometric Webauthn sign-in.

Ebay and Best Buy probably need minimal changes to be fully passkey friendly.

 

[fwmireault]

Do we need to enable something in the settings? I have the latest beta version of iOS 16, and tried all these apps, and no one offered me to enable Passkey

 

[8CoreWhore]

Do we need to enable something in the settings? I have the latest beta version of iOS 16, and tried all these apps, and no one offered me to enable Passkey

Try eBay in the browser.. app not updated yet... and it will look like this...

 

[raphiel]

List of FIDO2 Supported Sites & FIDO U2F Supported Sites | Hideez

The FIDO2 standard uses a private and public key to validate each user’s identity to achieve this. To use FIDO2 authentication, you’ll first have to sign up for it at FIDO2 supported sites. You’ll enjoy another advantage in the form of a more streamlined experience, as you won’t have to remember...

hideez.com

Think that is a good list

 

[ifxf]

I don’t see apple sites supporting passkeys.

 

[Shin-Ra]

As highlighted by the video in this WebKit blog, kayak.com fully supports passkeys.

You can create an entirely passwordless account.

update: You can create a brand-new passwordless account. If you have a pre-existing kayak account with a password, or you add a password to your passwordless account, there’s currently no way to delete the password.

There are some other improvements Kayak should still make, like supporting auto-fill for email entry. They let you create multiple passkeys, which is good, but there’s no way to manage your multiple passkeys with names or delete them.

These are the little usability details that’ll separate good Passkey support from the great.

 

[Ast3r10n]

Is anyone actually able to create a Passkey in PayPal yet? The app doesn't allow me to, and the website is so buggy (which is not surprising, it being PayPal) it dismisses the passkey prompt before I'm able to accept it.

 

[Shin-Ra]

PayPal doesn’t support passkeys yet. Just a password and optional 2-step verification.

Many people have mistaken 2-SV support for security keys as passkey support, but when a website does support passkeys, you don’t need to enter a password to log in. In fact, you need to be able to delete your old password once you have a passkey, otherwise the password is still the weakest point of entry.

BestBuy sort of supports passkeys (Sign In with WebAuthn) but if you have 2SV enabled it still asks for that in addition to the passkey. You also can’t delete your password yet.

Many websites/apps may delay password deletion until they’re satisfied their passkey implementation is working perfectly.

 

[Ast3r10n]

Most of these services don’t actually support passkeys yet. eBay does, but GitHub still sees it as a 2FA. It’s not great, but it’s a starting point. If only we were able to actually add one in PayPal…

 

[Shin-Ra]

Even eBay is limited as I think they use a cookie to tie the biometric log-in to the device you enable it on.

Try logging in on another device and eBay doesn’t even prompt for the biometric login. It’s not proper passkey support.

 

[gwhizkids]

One of the better kept “secret” new features of iOS 16 is the addition of passkeys: a new technology for unlocking apps on your phone. This technology, based on joint development throughout the industry, is designed to eventually supplant passwords as the means of unlocking apps (and hopefully someday devices).

Read more here: https://developer.apple.com/passkeys/

I encountered my first passkeys app (Kayak) yesterday sheet the release of iOS 16. Let’s list others here (I’ll make this a wiki)

Apps Supporting Passkeys

• Kayak

 

[gwhizkids]

All: This topic should be of sufficient interest that it should be in the main iOS 16 forum. Mods were nice enough to move it there. I'll add my contribution to the wiki post.

 

[Shin-Ra]

Several account/security middleware providers have working demos or production-ready services with passkey support.

hanko.io demo: passkeys.io

passage.id demo: passage.id/demo

ownid.com used by:

nescafe.com (possibly other Nestlé sites too)​

kenwoodworld.com​

delonghi.com​

carnival.com​

The OwnID accounts are a bit flawed in that if you delete your passkey or otherwise lose access to your account, they send a 4-digit code to your email, but once logged in you can’t add a new passkey.

Longer-term, I don’t know if allowing email recovery is considered best-practise because your email account might be poorly protected and the weakest point of entry.

 

[gwhizkids]

Several account/security middleware providers have working demos or production-ready services with passkey support.

hanko.io demo: passkeys.io

passage.id demo: passage.id/demo

ownid.com used by:

nescafe.com (possibly other Nestlé sites too)​

kenwoodworld.com​

delonghi.com​

carnival.com​

The OwnID accounts are a bit flawed in that if you delete your passkey or otherwise lose access to your account, they send a 4-digit code to your email, but once logged in you can’t add a new passkey.

Longer-term, I don’t know if allowing email recovery is considered best-practise because your email account might be poorly protected and the weakest point of entry.

Are these solid enough to add to the wiki post at the top of this thread?

 

[Marswarrior462]

The CardPointers app is the first passkey-supported app I’ve seen in the wild that is not locked behind some 2FA barrier as a ”security key” like Google and Microsoft. I tried setting up a passkey in Microsoft Authenticator but it wouldn’t let me because it thinks I’m on a private browser. I tried on the website but the option doesn’t exist, so I left a one-star review on the App Store to get their $h!t fixed