| |
| ▲ | 4 hours ago | parent | next [-] | | [deleted] | |
| ▲ | limagnolia 4 hours ago | parent | prev | next [-] | | If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website. | | |
| ▲ | horsawlarway 4 hours ago | parent | next [-] | | > But I am curious why one would need to login to a website in order to survive? They use bank like Ally or Discover with no physical branches. They use a mortgage provider like Rocket mortgage with no physical branches. They use a medication delivery service with no physical customer facing pharmacies. They have an employer that only facilitates reimbursement for expenses via online tools. etc... I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts. And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method" Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager. | |
| ▲ | epihelix 3 hours ago | parent | prev | next [-] | | If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost. What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system. | | |
| ▲ | AlienRobot 2 hours ago | parent [-] | | What confuses me is that for a long while we told people to not write their passwords on a sticky note, to not write them in plain text somewhere. Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes. Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note. Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them. It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge. |
| |
| ▲ | tavavex 3 hours ago | parent | prev [-] | | Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you. When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you. |
| |
| ▲ | vel0city 3 hours ago | parent | prev [-] | | Passkeys can exist on devices other than phones, so your entire premise is moot. | | |
| ▲ | tavavex 3 hours ago | parent [-] | | What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services. | | |
| ▲ | vel0city 3 hours ago | parent [-] | | > I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services. And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords. Aren't passkeys great? | | |
| ▲ | pixl97 2 hours ago | parent [-] | | You go to country X (USA sounds good to put in here). You get mugged. They take your phone and keyring. They can't do anything with it since it's locked, but you don't have it. Aren't passkeys great? | | |
| ▲ | staticman2 40 minutes ago | parent | next [-] | | Wouldn't I have the same problem with passwords? I would lose my phone and be unable to two factor log in to my Gmail account or bank from someone else's device? | |
| ▲ | jazzyjackson 2 hours ago | parent | prev [-] | | They can’t do anything with it I have a backup key at home Mission accomplished | | |
| ▲ | mrweasel an hour ago | parent | next [-] | | But the problem is that you can't really backup passkeys and because people are frankly frequent tricked into using them, they have no good recovery options. I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't. My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices. | | |
| ▲ | vel0city 5 minutes ago | parent | next [-] | | > But the problem is that you can't really backup passkeys The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords. To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever, or figure out some way to get me money to get home. Chances are I'll end up having to work with the embassy anyway. > My issue with passkeys are that they are designed for a reality that don't exist The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people. > I know plenty of people who only have a phone, no other devices. And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways. | |
| ▲ | pixl97 an hour ago | parent | prev [-] | | > designed for a reality that don't exist They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them. |
| |
| ▲ | rcxdude an hour ago | parent | prev | next [-] | | Do you have a plan for getting home without access to any of your accounts? And one of the problems with passkeys is that it's unreasonably difficult to keep a backup key. | | |
| ▲ | pixl97 an hour ago | parent [-] | | You're asking way too much foresight in this thread I guess. There are some people who have lived lives without any series of unfortunate events, they can't even imagine what the world can serve up. |
| |
| ▲ | tavavex an hour ago | parent | prev [-] | | Great, now I just need to get back home to use my uncompromised accounts (which would have still been protected by my device as long as the thieves aren't NSO Group, but whatever). Gee, it seems my tickets back home were taken with my stolen phone! Not to worry, they sent me an email confirmation, so all I need to do is log into my passkey-protected email on my friend's phone and have them download my ticket in addition to theirs, or print them at a public computer. Oh wait |
|
|
|
|
|
|
