What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival.

These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.

▲

3 hours ago | parent | next [-]

[deleted]

▲

limagnolia 3 hours ago | parent | prev | next [-]

If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.

▲

horsawlarway 3 hours ago | parent | next [-]

> But I am curious why one would need to login to a website in order to survive?

They use bank like Ally or Discover with no physical branches.

They use a mortgage provider like Rocket mortgage with no physical branches.

They use a medication delivery service with no physical customer facing pharmacies.

They have an employer that only facilitates reimbursement for expenses via online tools.

etc...

I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.

And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"

Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.

▲

epihelix 2 hours ago | parent | prev | next [-]

If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost.

What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.

	▲	AlienRobot an hour ago \| parent [-]
		What confuses me is that for a long while we told people to not write their passwords on a sticky note, to not write them in plain text somewhere. Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes. Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note. Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them. It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.

▲

tavavex 2 hours ago | parent | prev [-]

Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you.

When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.

▲

vel0city 2 hours ago | parent | prev [-]

Passkeys can exist on devices other than phones, so your entire premise is moot.

▲

tavavex 2 hours ago | parent [-]

What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.

▲

vel0city an hour ago | parent [-]

> I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.

And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords.

Aren't passkeys great?

▲

pixl97 an hour ago | parent [-]

You go to country X (USA sounds good to put in here).

You get mugged.

They take your phone and keyring.

They can't do anything with it since it's locked, but you don't have it.

Aren't passkeys great?

▲

jazzyjackson an hour ago | parent [-]

They can’t do anything with it

I have a backup key at home

Mission accomplished

▲

mrweasel 5 minutes ago | parent | next [-]

But the problem is that you can't really backup passkeys and because people are frankly frequent tricked into using them, they have no good recovery options.

I know plenty of people who only have phone, no other devices. They don't backup that phone, they shouldn't but they don't. They don't use a password manager either, maybe they should, but they don't.

My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.

▲

rcxdude 13 minutes ago | parent | prev [-]

Do you have a plan for getting home without access to any of your accounts? And one of the problems with passkeys is that it's unreasonably difficult to keep a backup key.

	▲	pixl97 6 minutes ago \| parent [-]
		You're asking way too much foresight in this thread I guess. There are some people who have lived lives without any series of unfortunate events, they can't even imagine what the world can serve up.