Too technical error message when trying to sign in with an invalid passkey about hanko HOT 3 CLOSED

I would also tend to "This passkey cannot be used anymore", because from the user's perspective the passkey is present (the browser suggests the user to use it), but the website is not accepting the passkey anymore. In the upcoming <hanko-profile> element, we should hint the user, before a passkey gets removed accordingly. I don't know about the use case that a admin can delete a user's passkey, but when the user is the only one that can delete passkeys, the suggested error message should be fine. "Invalid passkey" and "Passkey not found" are valid options too, but maybe we should be a little bit more precise, when we know, under normal circumstances, the passkey was there in the past.

from hanko.

I agree on this.

I have some thoughts on this though.
A new user, that have just been introduced to the technology, could get very skeptical about it, if they don't understand that it's a problem out of their hands. If they think that it is a problem on their device, it would make them try to avoid the technology going forwards. If it's stated that it's a problem, like a server error, database error etc., they know that it's not the technology, but a problem on the app or service.

A couple of suggestions:

1. "This passkey cannot be used anymore", as you said. However, it could make them think that the passkey is still stored somewhere or that it has been blocked. Could also show that there's something wrong with the passkey itself. But it's still describing the problem.

2. "Invalid passkey". Short, but describes the problem. It's also in line with the WebAuthn error message, but not too technical for the average user. But again, it could lead to a user thinking the passkey itself is not working, or that the user did something wrong.

3. "Passkey not found". More technical, but still describes the idea of the error. Shows the user that there's nothing wrong with the passkey, but that it just hasn't been found.

These three doesn't really satisfy my first thought, but I can't really come up with anything else, and I not really in on any of them, so more suggestions would be amazing😄
Have a nice day

from hanko.

Thanks for your thoughts. Some additional context:

This error message is shown when the server does not accept the passkey. This may be due to:

• The user deleted the (server-side) passkey in their profile settings (not yet supported, but we're working on it)
• The admin deleted the (server-side) passkey for the user
• The user does not exist anymore

In all cases, the passkey on the user's devices is still present and will pop up when the user tries to sign in. I wanted to let the message reflect that there is no technical error or something wrong, but it is up to the user to delete the passkey from their device because it will never work again.

from hanko.