Hacker News Reader

Aside from your email account and maybe a few other critical accounts, you should probably just not bother. If you lose your passkey there should be a "lost passkey" flow just like there has been for a forgotten password.

Each website should have a unique signing key. This is how you prevent one site from logging into another since the login is now just a signed challenge.

Does anything get stored on the device when you register on a site? As far as I know it does not.

> YubiKeys can store a maximum of 25 passkeys. We are evaluating increasing this in the future because of the likely increase in fully passwordless experiences across the web that require them.

Everyone knows there's no way to encrypt with one key and decrypt with another.

This is up to the authenticator and is completely possible.