Same here, also what if I lose the device?

I can safely write down a password on a piece of paper and keep it somewhere phyisically safe.

Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

▲

pas 2 days ago | parent | next [-]

password managers do the backup for you based on how you set them up (eg. to your google drive, or to a simple SFTP/FTPS/S3 URI)

those that don't have this built-in (eg. KeePassXC) recommend using Dropbox or some external sync mechanism

but the keys are stored in a file, which you can back up.

> all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor

no, not at all. it still gives you better UX, because when you use the passkey you know it's the site you want to log in to. (because there's mutual authentication.)

▲

jesseendahl 2 days ago | parent | prev | next [-]

>Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.

And email based account recovery does not make the security advantages of passkeys disappear, which are:

- credential that's guaranteed to be unique

- credential that's guaranteed to be strong

- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)

- changes the incentives for compromising servers (they're nothing worth stealing from the server -- only public keys)

- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks

	▲	realusername 2 days ago \| parent \| next [-]
		That doesn't really explain if I can use said website on my phone with a password if I login with a passkey on my computer
	▲	spaqin 2 days ago \| parent \| prev [-]
		Hopefully your e-mail is not tied to the passkey that you just lost.

▲

Telaneo 2 days ago | parent | prev | next [-]

2FA secrets can be backed up, and everyone should do that, for the same reason you'd want to do it with passwords.

Passkeys can too, but there it's even more obfuscated than with 2FA.

▲

izacus 2 days ago | parent | prev | next [-]

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life.

Why is there so much misinformation nonsense around passkeys?

▲

cpburns2009 2 days ago | parent | next [-]

How do you use a restored passkey from backup? Aren't they locked to the device?

▲

fhdkweig 2 days ago | parent | next [-]

That's all I want to know. How do I restore from a backup? Specifically, a backup that I make to a medium I control, like a piece of paper or a burned CD-R in a safe deposit box. If I could get a good answer to that, I could be onboard. But from the conversations that I am getting here, it looks like only certain managers allow it, and with device attestation, they could be banned at any moment by any website with no recourse.

▲

nozzlegear 2 days ago | parent [-]

> * and with device attestation, they could be banned at any moment by any website with no recourse.*

Isn't this true of any authentication method? It doesn't seem unique to Passkeys.

▲

fhdkweig 2 days ago | parent [-]

Now that I think about it, you are right. But if they could ban my use of written passwords as easily as banning my use of a particular passkey device, why go through all the extra hoops to just be as vulnerable as before? This seems like a whole lot of extra work to do that gains me nothing.

▲

fhdkweig 2 days ago | parent | next [-]

I think it is important to explain why I and others are so reluctant to this.

In security, you identify reasonable threats. You can't protect against all of them, and some may even be contradictory.

When I get a call on my phone that says "Potential Spam", I have never even once in my life decided to run over to my list of passwords and hand them over to the President of the Spanish National Lottery. Not even once.

But on many, many occasions I have dealt with a simple system that was replaced by a more complicated one and something in that Rube Goldberg machine broke down and deprived me of access to money, email, even a parking permit to my office.

Passkeys seem to protect against the former case that has never happened to me, while increasing the chances of the latter that has happened way too often.

▲

zdp7 a day ago | parent | next [-]

You aren't considering all the advantages of passkeys.

Passkeys only work on the domain they were created for. Password managers usually default to providing the password of the current website, but nothing stops you from pasting that in at any site.

There is no danger to the credential db being stolen. The website only has your public key.

A website using passkeys can support cross device authentication which allows you to login to on a computer without it ever seeing your credentials.

I'm sure that isn't a complete list. My last point, despite all the comments here, there is no vendor lock in. Bitwarden provides an open source self hostable option. On both Android and Windows 11, you can change your passkey provider to Bitwarden. A proper passkey implementation, should allow multiple passkeys to provide access. My bank does exactly that.

	▲	Izkata a day ago \| parent [-]
		> Passkeys only work on the domain they were created for. Password managers usually default to providing the password of the current website, but nothing stops you from pasting that in at any site. Considering how my bank has changed the sign-in domain three times (as well as some other sites), I consider this a feature, not a shortcoming.

▲

nozzlegear 2 days ago | parent | prev [-]

It should go without saying that, while you've never given your passwords over to the President of the Spanish National Lottery, there people who do get duped into doing exactly that all the time.

	▲	fhdkweig 2 days ago \| parent [-]
		I don't like the default option being to treat everyone like they are a moron. I don't like being treated like a moron.

▲

nozzlegear 2 days ago | parent | prev [-]

I don't think the goal of passkeys was ever about making it easier to back them up or protecting you from websites that could ban you. I think (correct me if I'm wrong) the goal was always to make it nigh impossible for attackers to phish your credentials.

▲

nozzlegear 2 days ago | parent | prev | next [-]

If you use Safari, they're locked to all of the devices on your iCloud account, not to a single device.

▲

izacus 2 days ago | parent | prev [-]

I login to 1Password on another device and all passkeys are there, and usable.

The OSes I use where that works fine:

- Android - Windows - Linux - macOS - iOS

▲

juancn 2 days ago | parent | prev [-]

How? Where are they stored? Which password protects them? How do I back them up? How do you move them to another device? Can I print them out on paper as a last resort measure?

Nobody fucking knows.

▲

pas 2 days ago | parent | next [-]

it depends on which password manager you are using. if you use Google's then it gets backed up to your Google account.

BitWarden, KeePassXC, and probably a bunch of other password managers have very thorough support for import-export, automatic/periodic backup, sync/merge, etc.

▲

juancn 2 days ago | parent [-]

And that's a HUGE issue. SSH keys are easy to manage in comparison to PassKeys.

	▲	tzs 2 days ago \| parent [-]
		Are they easier to manage if you have a few hundred SSH keys?

▲

izacus 2 days ago | parent | prev [-]

Why are you making stuff up? Of course people know where they're stored in password managers and how they're synced.

▲

varispeed 2 days ago | parent | prev [-]

Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.

▲

msandford 2 days ago | parent [-]

Nobody is safe from a nation-state "attack" they'll just go threaten your providers to give up your data. Passwords written on paper are probably safer than a centralized password manager for almost every circumstance other than a government coming after you.

▲

odux 2 days ago | parent | next [-]

Papers: Safe - yes. Easy to lose/misplace: also yes.

	▲	TeMPOraL 2 days ago \| parent [-]
		Humanity having millennia of experience securing them: also yes.

▲

NetMageSCW 2 days ago | parent | prev [-]

I’d like to see them threaten Apple or Bank of America.