As someone who actually uses them in a lot of places, the number of sites I know that only allows a single passkey is one: PayPal. What other sites do you know only allow a single one?

PayPal allows multiple passkeys. I just added passkeys there today and had no trouble making two.

I have a vague recollection of running into some trouble when I tried to add passkeys to an account in their sandbox (sandbox.paypal.com) but don't remember what it was. I realized I don't need any of my sandbox accounts any more and deleted them all from my password manager rather than try to solve the problems. :-)

They do now? That's good to hear. It's been probably close to a year since the last time I checked. Thanks for the update on that.

So then that really makes me wonder what all those other sites these people are using which do only allow a single passkey.

I haven't run across any single key sites.

PayPal's handling of multiple passkeys is kind of annoying. I didn't see any way to change the default labels it gives them, which appear to be simply the OS and browser names. So both of my passkeys are labeled "macOS Chrome".

Clicking on them tells when they were created but the resolution is only to the day.

If somehow my private key for one of the them leaked and I wanted to delete the public key I wouldn't know which to delete.

Some sites label the passkeys "1Password" and something like "Apple iCloud" which works a lot better.

I too first experimented with passkeys about a year ago, and then largely ignored them until this discussion prompted me to have another go.

A year ago I found them almost unusable. I had trouble getting browsers to recognize a passkey was available for a site, and I had trouble getting browsers on my Mac to use passkeys from the Apple keychain on my Mac. They would often put up a QR code for me to scan on my phone to use the passkey from the phone--and that was also not very reliable.

Now I'm hitting almost no problems.

There are still some settings annoyance with some sites. At PayPal for instance it asks for my TOTP code even when logging in with a passkey. There is no option to turn off TOTP for passkeys but leave it on for passwords.

Yeah, sites should ideally ask for a label at passkey creation with a decent autogenerated one.