The automatic naming of passkeys in the account security section is, well, garbage. It’s not accurate at all and for anyone using best practices who registers more than one passkey, the idea i can name a security key (U2F token) but not a passkey (FIDO2 token) is ridiculous.
Both of those passkeys were added to my account through Firefox, on Windows, however I used “Other Device” and then used my phone to set up the passkey using an NFC FIDO2 token with my phone. I have a primary and a backup NFC passkey.
The names and details the Shopify system came up with to identify my passkeys are just plain wrong.
Since I can’t name my passkeys or even give them a nickname in the system, I now can’t tell which is which. This is a critical flaw in the Shopify system as it hinders proper passkey management techniques.
Please allow users to name their passkeys like they can their U2F security keys.
The naming is not Shopify guessing badly, it is Shopify having nothing to guess from.
The only thing that identifies an authenticator model during a WebAuthn registration is the AAGUID in the attestation. A site has to ask for attestation to receive it, and most sites ask for none, because none avoids the extra browser prompt and the handling that comes with it. When attestation is none the browser zeroes the AAGUID out before the site ever sees it. So Shopify got all zeros for both of your registrations. What is left to label the entry with is the user agent that ran the ceremony, which was Firefox on Windows both times, even though the credential actually ended up on two different NFC tokens. Two entries, identical wrong details, exactly what you are looking at.
That is also why security keys behave differently in that list. You type the name yourself, so the server never has to infer anything.
Which means a rename field really is the only fix available here, there is no smarter inference sitting on the table that they are declining to do. Worth putting it that way in the request. Framed as make the auto naming better it reads as a polish item and it sits, framed as the data to do this correctly does not exist so let users type it, it is a much shorter argument.
Until then, if your list shows a created date, that is the field that separates your two entries. Registering the backup on a different day to the primary gives you something to tell them apart by. Does yours show a last used column as well? On some accounts that ends up being the faster tell.
“Firefox on Windows” is almost certainly your User-Agent, not the passkey. Nothing in WebAuthn tells the site which browser or OS you used, so that string can only come from the request carrying the registration. With “Other Device” that request came from the Windows machine while the credential was made on your NFC token &same browser, same day, both times, so both rows come out identical.
The field that does identify the authenticator is the AAGUID, in the attestation data. FIDO’s Metadata Service and the community AAGUID list map those to readable names.
That’s probably the sharper ask: store the AAGUID, label from it, and still let people rename.
The question am asking is whether the AAGUID survive a cross-device Firefox registration with attestation set to none? That decides whether this is a small fix or not..
