4 ms·

A few things I don't understand: 1) How can I share the fingerprint keys between chrome and safari? 2) How do I share keys between different types of devices?

A few things I don't understand: 1) How can I share the fingerprint keys between chrome and safari? 2) How do I share keys between different types of devices? (mac, ios, android, windows) 3) What happens if my devices are gone? 4) What happens if I want to change my login (email to a new email for example)? 5) Is account recovery handled simply by a reset-email? 6) It seems a validation step of the email is missing?

barkerja 4y ago
1. I don't believe you can, but I could be wrong. 2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS. 3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account. 4. I don't believe this is an issue specific to Passkeys. 5. Account recovery isn't really necessary, unless you hit up against point 3, in which case it's about recovering your ability to use the passkey and not so much the account. 6. If emails are being treated as usernames, they absolutely should be validated.
- cameronh90 4y ago
  > Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?
  - barkerja 4y ago
    I would assume so, but I'm not 100% sure. I personally haven't yet messed with Passkeys much aside from use on a couple of sites that have implemented them. My working assumption is if you wanted to use a new browser, you'd have to attempt to log into the service with the new browser. When the Passkey flow prompts you with a QR code to scan, you'd have to use your iPhone/iPad to scan that QR code to allow entry. What happens after that, I have no clue.
  - psanford 4y ago
    Part of the design is that every site will support multiple passkeys tied to an individual account. So it will be normal to use one browser to bootstrap registering another browser with a new passkey into your account. This video[1] by the FIDO alliance shows what that process will look like with a bunch of different OS and browser combos. [1]: https://www.youtube.com/watch?v=SWocv4BhCNg https://www.youtube.com/watch?v=SWocv4BhCNg
  - ylk 4y ago
    The keys aren’t stored in the browser. The browser just forwards to the hardware. Switching from one password/-key manager to another is going to be more of an issue. But you should be able to add an additional passkey once logged in to an account, just like how you can have multiple hardware 2fa keys now. Then you could manually migrate accounts that way, which is painful, of course, but you wouldn’t be completely locked in.
    - jbverschoor 4y ago
      I use both chrome and safari, and hate they don't use the same password store anymore (chrome used to just use keychain). But on iOS, you can at least fill in passwords using chrome as well
0x457 4y ago
> 1) How can I share the fingerprint keys between chrome and safari? If you're talking about TouchID then - keys aren't stored in a browser, they stored in whatever powers Touch ID (secure enclave?). So any browser that supports Webauthn will be able to reuse it. > 2) How do I share keys between different types of devices? (mac, ios, android, windows) Yes. I have multiple hardware keys that I use on: iPadOS, Android, Mac, Windows, Linux. Key exposes itself as HID, so it "just works" > 3) What happens if my devices are gone? Then you have to perform account recovery, just like when you forget your password > 4) What happens if I want to change my login (email to a new email for example)? Email isn't stored on the key. So changing email to a new email if entirely dependent on service you're logging in, just like in case of a password. > 5) Is account recovery handled simply by a reset-email? This is unrelated to passkeys and webauthn. This is a replacement for authentication, not account management, so yes, it's handled the same in a way that is entirely up to service how to handle it. > 6) It seems a validation step of the email is missing? I think at this point you can answer this question yourself?
- deleted 4y ago
  [deleted]
greggman3 4y ago
Watch the video linked below by psanford 1) How can I share the fingerprint keys between chrome and safari? You don't need to. That's not how it works. Chrome and Safari and every device will have a different key for the same service (see video) 2) How do I share keys between different types of devices? (mac, ios, android, windows) You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/sofware. (See video) 3) What happens if my devices are gone? You follow whatever recovery procedures the service has. 4) What happens if I want to change my login (email to a new email for example)? Unrelated. Your email is not shared with passkey. So login and set a new email 5) Is account recovery handled simply by a reset-email? That's up to the site/service just like it is without passkey 6) It seems a validation step of the email is missing? That's up to the service as well. They could require an email but that's unrelated to passkey

barkerja 4y ago

1. I don't believe you can, but I could be wrong. 2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS. 3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account. 4. I don't believe this is an issue specific to Passkeys. 5. Account recovery isn't really necessary, unless you hit up against point 3, in which case it's about recovering your ability to use the passkey and not so much the account. 6. If emails are being treated as usernames, they absolutely should be validated.

cameronh90 4y ago
> Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?
- barkerja 4y ago
  I would assume so, but I'm not 100% sure. I personally haven't yet messed with Passkeys much aside from use on a couple of sites that have implemented them. My working assumption is if you wanted to use a new browser, you'd have to attempt to log into the service with the new browser. When the Passkey flow prompts you with a QR code to scan, you'd have to use your iPhone/iPad to scan that QR code to allow entry. What happens after that, I have no clue.
- psanford 4y ago
  Part of the design is that every site will support multiple passkeys tied to an individual account. So it will be normal to use one browser to bootstrap registering another browser with a new passkey into your account. This video[1] by the FIDO alliance shows what that process will look like with a bunch of different OS and browser combos. [1]: https://www.youtube.com/watch?v=SWocv4BhCNg https://www.youtube.com/watch?v=SWocv4BhCNg
- ylk 4y ago
  The keys aren’t stored in the browser. The browser just forwards to the hardware. Switching from one password/-key manager to another is going to be more of an issue. But you should be able to add an additional passkey once logged in to an account, just like how you can have multiple hardware 2fa keys now. Then you could manually migrate accounts that way, which is painful, of course, but you wouldn’t be completely locked in.
  - jbverschoor 4y ago
    I use both chrome and safari, and hate they don't use the same password store anymore (chrome used to just use keychain). But on iOS, you can at least fill in passwords using chrome as well

0x457 4y ago

> 1) How can I share the fingerprint keys between chrome and safari? If you're talking about TouchID then - keys aren't stored in a browser, they stored in whatever powers Touch ID (secure enclave?). So any browser that supports Webauthn will be able to reuse it. > 2) How do I share keys between different types of devices? (mac, ios, android, windows) Yes. I have multiple hardware keys that I use on: iPadOS, Android, Mac, Windows, Linux. Key exposes itself as HID, so it "just works" > 3) What happens if my devices are gone? Then you have to perform account recovery, just like when you forget your password > 4) What happens if I want to change my login (email to a new email for example)? Email isn't stored on the key. So changing email to a new email if entirely dependent on service you're logging in, just like in case of a password. > 5) Is account recovery handled simply by a reset-email? This is unrelated to passkeys and webauthn. This is a replacement for authentication, not account management, so yes, it's handled the same in a way that is entirely up to service how to handle it. > 6) It seems a validation step of the email is missing? I think at this point you can answer this question yourself?

deleted 4y ago
[deleted]

greggman3 4y ago

Watch the video linked below by psanford 1) How can I share the fingerprint keys between chrome and safari? You don't need to. That's not how it works. Chrome and Safari and every device will have a different key for the same service (see video) 2) How do I share keys between different types of devices? (mac, ios, android, windows) You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/sofware. (See video) 3) What happens if my devices are gone? You follow whatever recovery procedures the service has. 4) What happens if I want to change my login (email to a new email for example)? Unrelated. Your email is not shared with passkey. So login and set a new email 5) Is account recovery handled simply by a reset-email? That's up to the site/service just like it is without passkey 6) It seems a validation step of the email is missing? That's up to the service as well. They could require an email but that's unrelated to passkey