Hey Steven, thanks for getting back to me!
Just to be clear, when i'm talking about 'passkeys' I'm talking about 'device authentication'. Passkeys are a new technology that websites, apps and online services can let users use the device biometrics (faceID/touchID/fingerprint/Windows Hello etc) to authenticate themselves into their accounts without having to enter/use a password. This will be something more and more places will be supporting in future, and Google accounts added support for it, just this week! You'll see a list of places supporting passkeys here: https://passkeys.directory.
As a side note, if you go to the 'My Virgin Media' app, it kicks you out to the website to use this functionality/setup - so I don't think this is where the issue might be, or if i'm mistaken I apologise in advance. 😂
I'll try and list things out in a way that hopefully helps to describe the issue I'm having, which perhaps you might pass on to your web developers/QA team to test and debug.
Here's how things are when they go well:
- The first time a user signs in to https://www.virginmedia.com/my-virgin-media using a device that supports webauthn/passkeys, they are prompted to create a passkey (although Virgin Media have chosen to not call them a passkey nor are using the FIDO official icon that will/should be associated to 'passkeys' on the account settings screen - instead, we have half face/half fingerprint icon. Which does help new users to passkeys understand what they're related to so thats good, but a little confusing to others for now.)
- If the user proceeds to setup their device authentication, they will receive a prompt from their browser/system/authenticator of choice that supports passkeys, to create a passkey. This is exactly how your support docs describe - happy days!
- The passkey the user's created will be available in the account settings, and everything's good.
⚠️ However, I've found when doing this on iOS16 on my iPhone I am not prompted to create a passkey if I remove the previously stored passkey. (which users may do when changing devices or for any reason they choose.) If I am signing in on a device that supports passkeys, and there are no passkeys stored - I should get the option to set it up. Now, ideally, the account settings page would let users set up a passkey there instead of relying upon a flag that the browser uses to check if a user has previously created a passkey or not and hide the message if this is the case.
⚠️ Also I am not able to use a passkey manager/authenticator that creates passkeys as the popup does not appear for me in chrome or firefox browsers where an authenticator is present. It does in Safari (desktop/macOS) but not iOS Safari.
The support docs do include something quite strange though, "For your security, the number of devices you can register is limited." Which, seems a bit restrictive given that passkeys do not (to the best of my knowledge) need to be limited to a certain number of devices, however I can follow this up with the FIDO alliance to see if this is solid security guidance.
I'd love to know if there's something that can be done to allow iOS to setup more passkeys again, or if the devs are planning to make some improvements to this future authentication method. 🤞
Cheers for reading - and hopefully this helps
Ben
