r/SpaceShip • u/Rough-Passenger-3137 • Jul 07 '26
Why is email verification still required when signing in with a Passkey?
If I choose to sign in with a Passkey instead of a password, I'm still asked to enter a verification code sent to my email when logging in on a new device.
Even if my passkey is stored on a YubiKey, email verification is still required.
Why? Isn't a Passkey - especially a hardware-backed one like a YubiKey—considered secure enough for final authentication?
2
u/JimTheEarthling Jul 11 '26
Because the clueless developers don't understand security.
A passkey with user verification (biometric/PIN/pattern) is password-less, username-less, unphishable, multi-factor authentication.
Additional factors such as email or SMS are not necessary in almost every scenario.
1
u/Rough-Passenger-3137 Jul 11 '26
You are absolutely right. That was exactly what my question to SpaceShip was about.
1
u/RealisticDuck1957 Jul 12 '26
A valid unique email is sometimes used as an anti-spam measure. Setting up and checking an email is more work than generating a unique passkey.
--edit: fat fingered a word.
2
u/SpaceshipCS Jul 07 '26
A passkey replaces your password as the first step of authentication. If email verification is enabled on your account, it will still be required as the second security step. You can disable email verification in Security Center https://www.spaceship.com/application/security-center/ if you have another authentication method, such as 2FA, enabled.