Adding a passkey makes it mandatory as MFA on other devices

(#1377) Feature Shipped security

Thread

Comment by @nwenny
RexSystem 1 vote originally by @nwenny on GitHub
This really seems like unintended behavior. I set up a passkey on my phone to make it easier to log in on mobile, and I expected this to only be for my phone. The reality is that it's now a passkey for all my devices, and obviously that's not something that works. I can't log in on my laptop anymore, and I can't set up 2FA because it wants a passkey that my computer does not have. I tried deleting the passkey and I can't because it errors. I'm relatively new to adding passkeys to my accounts, but I don't think I've ever seen a passkey implemented this way in anything I've ever touched. I enjoy using Fluxer but this is frustrating and a little alarming. If I get locked out of my desktop, I lose the primary way I 1. use Fluxer and 2. talk to a partner. A passkey shouldn't be used as mandatory 2FA unless that's explicitly enabled by the user. At the very minimum a warning should be there stating that this is 2FA and not just an alternative login method. Much more important edit: Oh to add to this, the passkey doesn't even work. It doesn't do anything on my phone. So I couldn't do anything about this if I tried. I'm too nervous paying for a subscription to an account I could just randomly lose access to and never get back into, so I'm gonna have to cancel that until something changes.