TL;DR: Passkeys are pushed to consumers without enough computer knowhow. How to cope with them loosing access to their accounts when windows needs to be reinstalled or when changing to new PC?

Helping people with their PC troubles

I am (like probably many of you) the point of contact for relatives and private customers in case they need computer support. I‘m trying to take most of the burden from them, by setting up an easy data backup, by making a yearly disk image to have a working windows to return to in case disaster strikes and by trying to remove as many trap doors as possible. When they change to a new PC they contact me. I transfer all the files, bookmarks and maybe passwords stored in the browser(s). When windows crashes, stops working or is otherwise freaking out, I can create a disk image to have something to return to if my repair attempts fail.

Accounts with Passkeys at Risk

But lately more and more of these people are pushed into using passwordless authentication by Microsoft, Google and the likes, but without knowing about the consequences*. So we can assume they have no alternate way to log in or sometimes not even a valid login reset (old email addresses or old mobile numbers are frequently the case)

Passkeys can not be backed up or transferred that way. So they might loose access to these accounts when changing to a new PC, when a disk image has to be restored or windows has to be reinstalled.

*: We know that we always must have an alternate way to log in or to recover an account if we secure an account with 2FA or passkey (like a second passkey/fido-key, a valid reset channel etc.). But most people don‘t, sometimes they have not even a clue if an email address or mobile number attached to the account is still valid.

How to handle Passkeys for a client when changing to new PC or reinstalling windows

I‘m at loss how to handle this in the future (let‘s put aside the method of syncing passwords and passkeys to ones online microsoft-account). Of course I can sit down with the client to generate alternate passkeys on other devices or to check for working login reset mechanisms for each and every account and create new passkeys on a new PC (or after reinstall), but that will add a significant amount of time.

Do you see solutions for the „non wizard“ users or for us when working on their PCs?

Most open source projects are important alternatives to escape pilitical and commercial control/limitations/censorship existant in commercial products, driven by commercial interests. With the current situation all US-based companies are even more subject to political pressure.

An embargo by the US towards any country/entity would mean US companies have to shut down their services for that entity.

As many open source projects seem to be hosted on github (M$), could they be blocked nearly instantly? Thus giving the pumpkin the power to sabotage alternatives to US controlled tools?

(Hope I‘m not in the wrong community to bring this up. Hints to better suited places are welcome.)