🚀 Feature: Explain how to link more devices

[levino]

Feature description

Please explain how to link more devices.

Say as one of my users, I create an account with a passkey which I store on my mobile phone. Later this user wants to access their account from another device (say mac or pc). How do they link the passkey from the mac to the same account?

Pitch

Could be something for #88 .

[simono41]

I manage my passkeys across devices with vaultwarden. Otherwise, you would have to create a passkey for each device individually, or use a Yubikey.

[stonith404]

This isn't really Pocket ID specific but it depends where you store your passkeys. Like @simono41 said, you can store it in a password manager or on a physical Yubikey. Apple for example also allows you to sync the passkeys with the iCloud Keychain around your devices.

Alternatively you could also store it only on your phone and then sign in by scanning the QR code that was generated by the browser on your pc.

[levino]

What I could imagine would be some kind of short lived, one time "invite link". The user could generate this link, send it to the other device and then link that key. For example some people have an android phone AND a mac. There are few and kinda cumbersome solutions to sync secrets between these devices. One can use the secret on the phone via chrome from the mac, but this somehow always fails for me.

Also another thought: For a mac, one can enable "login with passkey" and remove the password. But only if one has linked at least two physical passkeys and clicks "okay" multiple times in forms where one has to acknowledge that one never stores the passkeys in one location. This makes a lot of sense to me for reasons you will probably understand. In this sense one could also mark a user account with only one registered passkey "critical" or something and make warnings to quickly add a second passkey.

[stonith404]

Yeah, I think it would be a good idea to let users create a one-time access link so they can add a passkey from another device. It shouldn’t be too hard to implement since admins can already create one-time access links for users.

Adding a warning when only one passkey is registered also makes sense. However, the user should be able to dismiss the warning, because if they lose the passkey, the admin can still recover the account.

Could you create a feature request for both ideas so I can track them more easily?