If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.

▲

horsawlarway a day ago | parent | next [-]

> But I am curious why one would need to login to a website in order to survive?

They use bank like Ally or Discover with no physical branches.

They use a mortgage provider like Rocket mortgage with no physical branches.

They use a medication delivery service with no physical customer facing pharmacies.

They have an employer that only facilitates reimbursement for expenses via online tools.

etc...

I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.

And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"

Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.

▲

epihelix a day ago | parent | prev | next [-]

If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost.

What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.

▲

AlienRobot a day ago | parent [-]

What confuses me is that for a long while we told people to not write their passwords on a sticky note, to not write them in plain text somewhere.

Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes.

Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note.

Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them.

It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.

	▲	dwaite 13 hours ago \| parent [-]
		FWIW my break-the-glass actual use of backup codes is for access to my password manager. Everything else which has ever given me a backup code... gets stored in a secure note in my password manager. It is just another knowledge-based factor. It is one that they are reasonably sure you aren't spreading around the internet. It is one that the site gets to pick rather than the user. But in reality, they are a often just a way to try to reduce some support and identity verification costs. The path to get to the password manager is the case where the backup codes truly matter, because without them there may not be a way for support to restore access. Those codes may be your only way of regaining the master encryption key. But that also winds up being part of the trade-off of security vs user friendliness. Some password managers are way easier to get back into.

▲

tavavex a day ago | parent | prev [-]

Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you.

When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.