This is a legitimate problem, and one of the few cases where a third party login provider makes sense, at least for non-critical “apps”. If both tokens can be authorized to that provider, then you don’t need to enroll any more tokens for apps using that provider. The difficulty is creating a trustworthy provider system without weakening security (the provider shouldn’t be able to login without you) that doesn’t collect information about you and which can’t lock you out from all your accounts.

I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.

▲

lxgr 2 hours ago | parent [-]

Why would you choose that over a synchronizing passkey manager?

A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.

The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.

▲

iamnothere 2 hours ago | parent | next [-]

> Why would you choose that over a synchronizing passkey manager?

No second factor, compromised passkey manager leads to compromise of all accounts. This is a huge problem.

> A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.

Yes that’s what I was saying, it needs some thought and careful work. It would need to be decentralized, and I’m not sure that current standards are up to the task.

▲

UltraSane 2 hours ago | parent | prev [-]

"A third party OAuth provider puts you at the mercy of the service provider" This is they key issue with trusting a third party to manage my passkeys, they can also BLOCK them and lock me out. An exception is if the passkeys are synced to all your devices and cannot be remotely wiped. I think this is how Apple works.

	▲	iamnothere 2 hours ago \| parent [-]
		I didn’t think of this in the moment, but you’re right, this is an even bigger risk than compromise. There’s regularly a thread here about someone getting locked out of their cloud accounts, and now we’re going to gate everything behind those same accounts? Horrible idea.