## 6 Limitations and Challenges in Passkeys
### Account Revocation
#### 6.1.3 Perception Challenges  
The users' perception is a crucial challenge to mitigate before enabling widespread adoption. Even though FIDO2 provides strong security features and can limit phishing attack surfaces, its dependency on a user's device creates potential barriers to confident adoption. If, for instance, one user wishes to switch from one ecosystem to another, there might be migration issues, or this might not be possible altogether. Furthermore, if a device is lost or damaged, it may create recovery challenges [7; 14; 84]. Using the known recovery mechanism, such as email-based recovery or backup codes, often undermines the security strength of FIDO2 and the absence of a clear recovery mechanism aids the concern for adopting the new authentication mechanism [7; 14; 48; 73; 79; 88]. Despite an ecosystem often allowing for seamless transition across devices without additional setup, it is usually not the case with passkeys as they are device-bound [69]. Though Apple has provided a solution using their iCloud platform to, according to them, securely transfer the passkeys across their devices, excluding any non-Apple device [26]. Users also face difficulties navigating security settings and understanding technical instructions for setup on various platforms, where the interfaces are often different, creating a steeper learning curve [7; 42]. Therefore, a simple and intuitive approach for migrating from password-based to passwordless setup is essential [90]. A study on German ID cards showed that users often still find the setup process of FIDO2 authenticators cumbersome, particularly when integrating devices like German ID cards or hardware tokens. This issue is exacerbated for non-technical users, who often struggle with software installation and understanding the required steps [11; 90]. Privacy is also a concern among many users, where fears of tracking or data misuse created a substantial barrier to adoption, despite FIDO2 being designed to mitigate such risks [7]. As it is notoriously known, many people often mistrust change and new things. The same can be said for new technologies, where users frequently exhibit mistrust due to unfamiliarity. The transition from \"something you know\" (passwords) to \"something you have\" (passkeys) represents a paradigm shift that some find unsettling [7]. As passwordshave been the primary authentication mechanism for decades, many users are accustomed to the text-based authentication mechanism and may struggle to grasp the conceptual differences between passwords and passkeys [27]. This may lead to viewing passkeys as more complex and thinking that the benefits are not significant enough to change, or users might tend to prefer methods they are already accustomed to, even if these are less secure [7; 11; 42; 73; 79; 80; 84; 86; 89; 90]. Some users might find password managers sufficient to handle the ever-increasing number of passwords associated with different websites, further decreasing the perceived need for change [84]. The misalignment in recovery, usability across multiple devices, and how the authentication flow works may also make users hesitant to trust passkeys, fearing the loss of control over their authentication process [73; 89]. Transitioning from password-based systems to passkeys also requires users to adapt to new workflows, such as managing authenticators and understanding device registration processes, which may be challenging for less tech-savvy individuals [11; 48; 82; 88]. The initial setup process might also seem overly technical or cumbersome for non-technical users, leading to a disregard for change [14; 89]. Users do not understand the general cryptographic safeguards of FIDO2 well, leading to skepticism about its efficacy [11; 90]. As passkeys are relatively new to the public, many users often misunderstand the authentication flow.