mirror of
https://github.com/anonaddy/anonaddy.git
synced 2026-04-24 21:55:52 +03:00
[GH-ISSUE #791] Add support for signing in with passkeys #1107
Labels
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/anonaddy#1107
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @gracjankn on GitHub (Nov 19, 2025).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/791
I’m happy that Addy.io supports passkeys (as well as physical security keys) as 2FA, but it’s not the ideal way of implementing WebAuthn.
Passkeys alone provide way better security compared to f.e. a password with TOTP and close if not equal to a password with a U2F security key.
There's no need to require the user to enter the password before presenting a passkey. It provides little to no security benefit while making the experience worse.
It should be possible to sign in with just a passkey.
It can be done by adding a dedicated "Sign with a passkey" button to the login page. There's also a way for browsers to automatically suggest a passkey to the user if one is available (similar to password autofill), making the experience even simpler.
I'm also of the opinion that it should be possible for users to fully remove the password from the account after adding one or more passkeys, thus creating a fully passwordless and phishing-resistant account.
If I have a passkey set up, the password is not an asset — it's a liability. I don't want it to be there.
At some point, it should also become possible to be able to sign up with a passkey, having never created a password in the first place.
@Pandooroo commented on GitHub (Feb 7, 2026):
I second this. I don't see much reason to have Passkeys available if i'm required to login with my credentials anyway whilst not having the option to log in via Passkey.