Why does losing my phone mean choosing between lockout and SMS fallback?
机会
Passkeys eliminate passwords but introduce a fragility the FIDO2 spec does not solve: account recovery. If you lose your only enrolled device and have not pre-configured vendor-specific sync, you are locked out or forced back to SMS OTP, which re-opens the SIM-swap attacks passkeys were supposed to close. Apple, Google, and Microsoft each built incompatible sync silos, so moving from iOS to Android means re-enrolling at every service by hand. The WebAuthn spec defines how to create and use credentials but explicitly defers recovery to each platform. No vendor-neutral, cryptographically sound recovery primitive exists that preserves the original threat model.
为什么重要
Recovery is the weakest link in the passwordless stack, and solving it is the last mile that makes passkeys a viable replacement for passwords at scale.
我如何评估机会
机会评分是我的个人判断，而非量化指标：痛苦程度、发生频率，以及当前解决方案的匮乏程度。分数越高，意味着我认为越值得去构建。
出现时造成的痛苦程度。
人们实际遇到它的频率。
当前针对它的优质工具有多匮乏。