TLDR Tech / InfoSec
Please, please, please stop using passkeys for encrypting user data
Using passkeys' WebAuthn PRF (Pseudo-Random Function) extension to derive encryption keys for E2EE (End-to-End Encrypted) data dangerously couples data availability to authentication credentials, dramatically increasing the “blast radius” of routine credential loss or deletion. Common password-manager UIs don't clearly communicate that deleting a passkey may permanently orphan encrypted backups, so users can recover their account via other methods yet still be unable to decrypt or restore their data—effectively a self-inflicted, irreversible data-loss scenario. If you must use PRF, add prominent up-front warnings and support documentation, and push credential managers to show explicit deletion warnings for PRF-enabled passkeys.
Read the full story