5 ms·

What happens if they lose the device?

xyzzy123 4y ago
The device tends to be tied to an underlying "cloud identity" (apple id, google account, microsoft account etc). You can use that account to re-enrol / manage devices etc. Ideally people have more than 1 device enrolled to enable easy fallback if one is lost. However, if the user loses access to their primary / cloud account for any reason, they will have a bad day.
- _Algernon_ 4y ago
  What happens when google bans your entire google account for watching Ukraine supporting live streams? https://news.ycombinator.com/item?id=30467384 https://news.ycombinator.com/item?id=30467384
  - cute_boi 4y ago
    Obviously, Google wont care and people will lose their fortunes. Some of them will come to hacker news and grouse that they have been treated unfairly. Government will remain silent because they can easily spy on people from data obtained from "big" techs.
    - account-5 4y ago
      This exactly.
- account-5 4y ago
  A number of these FIDO posts are cropping up and I still don't really get it. Someone in a previous one explained the benefits over and above my current password manager set up. However you have articulated the single biggest problem with this, and that is you are not in control of this thing. I'm activity not tying anything to a cloud identity, ever. And I'm not having multiple devices or multiple cloud identities for when Google's et. al. automated AI type system decides I'm not getting access to my stuff. It seems to me a centralised single point of weakness open to exploitation from the multi national corps.
  - dan-robertson 4y ago
    Part of it is about avoiding the possibility of screwing up by eg picking poor passwords or giving your password to the wrong site or allowing replay attacks (though I guess tls mostly protects from that). You don’t need to rely on cloud backups, though many users will. It is also usually possible to set up things like account recovery codes (which you print out and put somewhere safe) or TOTP auth (more useful if you eg aren’t able to carry a yubikey everywhere with you / can’t plug it into your phone).
  - nixpulvis 4y ago
    Fundamentally, there should be no need for a "cloud identity". I have a couple Yubikeys, for example, and I can treat them like keys to my house. Somewhat different, in that I cannot make a copy as directly, but that's honestly a good thing. I just have most of my applications set up to accept at least two of these keys, and I store one as backup generally along with a file-based key as backup somewhere secure. This is essentially what the cloud services should have on your account to "re-enroll" you, just self-managed. I want to get to the point where I can treat my physical keychain's USB/NFC (though, call me old school, I really like the direct physical connection) key much like a car key. Even automatically locking my laptop when I remove it (or get too far away).
    - xyzzy123 4y ago
      Agree on fundamentals - after all that's how it works now, you don't need FAANG for this. I do suspect that until it works "by default" for most users (without requiring any explicit configuration, backup or maintenance) then adoption will remain low.
      - nixpulvis 4y ago
        Yep. That's why I always hope for layers of standards. Lower level standards to enable higher level standards eventually all the way up to your gramps.
      - ryukafalz 4y ago
        > I do suspect that until it works "by default" for most users (without requiring any explicit configuration, backup or maintenance) then adoption will remain low. That is exactly what these recent announcements from the big platforms have been about.

The device tends to be tied to an underlying "cloud identity" (apple id, google account, microsoft account etc). You can use that account to re-enrol / manage devices etc. Ideally people have more than 1 device enrolled to enable easy fallback if one is lost. However, if the user loses access to their primary / cloud account for any reason, they will have a bad day.

_Algernon_ 4y ago
What happens when google bans your entire google account for watching Ukraine supporting live streams? https://news.ycombinator.com/item?id=30467384 https://news.ycombinator.com/item?id=30467384
- cute_boi 4y ago
  Obviously, Google wont care and people will lose their fortunes. Some of them will come to hacker news and grouse that they have been treated unfairly. Government will remain silent because they can easily spy on people from data obtained from "big" techs.
  - account-5 4y ago
    This exactly.
account-5 4y ago
A number of these FIDO posts are cropping up and I still don't really get it. Someone in a previous one explained the benefits over and above my current password manager set up. However you have articulated the single biggest problem with this, and that is you are not in control of this thing. I'm activity not tying anything to a cloud identity, ever. And I'm not having multiple devices or multiple cloud identities for when Google's et. al. automated AI type system decides I'm not getting access to my stuff. It seems to me a centralised single point of weakness open to exploitation from the multi national corps.
- dan-robertson 4y ago
  Part of it is about avoiding the possibility of screwing up by eg picking poor passwords or giving your password to the wrong site or allowing replay attacks (though I guess tls mostly protects from that). You don’t need to rely on cloud backups, though many users will. It is also usually possible to set up things like account recovery codes (which you print out and put somewhere safe) or TOTP auth (more useful if you eg aren’t able to carry a yubikey everywhere with you / can’t plug it into your phone).
- nixpulvis 4y ago
  Fundamentally, there should be no need for a "cloud identity". I have a couple Yubikeys, for example, and I can treat them like keys to my house. Somewhat different, in that I cannot make a copy as directly, but that's honestly a good thing. I just have most of my applications set up to accept at least two of these keys, and I store one as backup generally along with a file-based key as backup somewhere secure. This is essentially what the cloud services should have on your account to "re-enroll" you, just self-managed. I want to get to the point where I can treat my physical keychain's USB/NFC (though, call me old school, I really like the direct physical connection) key much like a car key. Even automatically locking my laptop when I remove it (or get too far away).
  - xyzzy123 4y ago
    Agree on fundamentals - after all that's how it works now, you don't need FAANG for this. I do suspect that until it works "by default" for most users (without requiring any explicit configuration, backup or maintenance) then adoption will remain low.
    - nixpulvis 4y ago
      Yep. That's why I always hope for layers of standards. Lower level standards to enable higher level standards eventually all the way up to your gramps.
    - ryukafalz 4y ago
      > I do suspect that until it works "by default" for most users (without requiring any explicit configuration, backup or maintenance) then adoption will remain low. That is exactly what these recent announcements from the big platforms have been about.