3 ms·

I can't see how site authentication tied to a single device is a good thing. If I sign up for a service I can never sign into it unless I have that device with

I can't see how site authentication tied to a single device is a good thing. If I sign up for a service I can never sign into it unless I have that device with me. For some ultra secure things that's a good thing, for day to day shopping, etc, it's so inflexible as to be useless. Again what happens when the device breaks or is lost or stolen? How do I migrate my credentials from Mac to android to windows to Linux to iOS? I'll be sticking with my password manager until I'm unable to use it.

monocasa 4y ago
You don't tie it to a single device. For consumers: it's considered good form for these services to allow multiple webauthn devices tied to an account. So you keep a yubikey somewhere to get back in, on the off chance that you simultaneously lose access to your phone and your computer. For corporate accounts: an admin provisions a new device for you and gives it to you.
- account-5 4y ago
  Ok that's fine but that assumes the consumer is going to have more than one device, and has the wherewithal to authenticate to the same service from multiple devices. Since this technology is in a large part a response to consumers utilising passwords badly I don't see this as a valid assumption. Let's ignore that some consumers won't have their own devices and therefore won't be able to use any service with this in place. I know people who do online banking at the library because they have no choice. My current set up with my password manager offers way more flexibility. And the only downside it that the password gets transmitted, encrypted, but it leaves my device.
  - signal11 4y ago
    I’m really interested in 1Password’s approach to WebAuthN[1]. If they can deliver on their cross-platform promise, other projects will likely be able to do so too. [1] https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/
    - account-5 4y ago
      I'm definitely all for passkeys (public/private key cryptography) as a replacement for passwords. But like passwords it needs to be in my control, cross platform and device, and not relying on some multinational targeted advertising cooperation's goodwill. Hopefully keepass[xc] role out support too.
- gnufx 4y ago
  For "corporate" accounts, isn't PIV better, since it works with more than web (like Kerberos without contortions) and lives on your id card fairly readily?
  - deleted 4y ago
    [deleted]
pabs3 4y ago
IIRC Passkeys will be synced to the cloud so they can be copied to multiple devices.
- account-5 4y ago
  For me it has to be offline and local. I don't want any cloud provider having my secret keys encrypted or not. I wouldn't put my password vault in the cloud and neither will I put any passkeys either.
  - fragmede 4y ago
    For everyone else, there's 1Password
  - pabs3 4y ago
    See this comment up-thread about some non-proprietary mostly-software-only ways to manage WebAuthn keys: https://news.ycombinator.com/item?id=33948929 https://news.ycombinator.com/item?id=33948929 Another option is to use hardware keys running open source user-controlled software, like the Tomu: https://tomu.im/ https://tomu.im/
sebazzz 4y ago
That's why you add your Windows computer fingerprint, Apple FaceID from your iPhone, and your Yubikey as authentication methods.

monocasa 4y ago

You don't tie it to a single device. For consumers: it's considered good form for these services to allow multiple webauthn devices tied to an account. So you keep a yubikey somewhere to get back in, on the off chance that you simultaneously lose access to your phone and your computer. For corporate accounts: an admin provisions a new device for you and gives it to you.

account-5 4y ago
Ok that's fine but that assumes the consumer is going to have more than one device, and has the wherewithal to authenticate to the same service from multiple devices. Since this technology is in a large part a response to consumers utilising passwords badly I don't see this as a valid assumption. Let's ignore that some consumers won't have their own devices and therefore won't be able to use any service with this in place. I know people who do online banking at the library because they have no choice. My current set up with my password manager offers way more flexibility. And the only downside it that the password gets transmitted, encrypted, but it leaves my device.
- signal11 4y ago
  I’m really interested in 1Password’s approach to WebAuthN[1]. If they can deliver on their cross-platform promise, other projects will likely be able to do so too. [1] https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/
  - account-5 4y ago
    I'm definitely all for passkeys (public/private key cryptography) as a replacement for passwords. But like passwords it needs to be in my control, cross platform and device, and not relying on some multinational targeted advertising cooperation's goodwill. Hopefully keepass[xc] role out support too.
gnufx 4y ago
For "corporate" accounts, isn't PIV better, since it works with more than web (like Kerberos without contortions) and lives on your id card fairly readily?
- deleted 4y ago
  [deleted]

pabs3 4y ago

IIRC Passkeys will be synced to the cloud so they can be copied to multiple devices.

account-5 4y ago
For me it has to be offline and local. I don't want any cloud provider having my secret keys encrypted or not. I wouldn't put my password vault in the cloud and neither will I put any passkeys either.
- fragmede 4y ago
  For everyone else, there's 1Password
- pabs3 4y ago
  See this comment up-thread about some non-proprietary mostly-software-only ways to manage WebAuthn keys: https://news.ycombinator.com/item?id=33948929 https://news.ycombinator.com/item?id=33948929 Another option is to use hardware keys running open source user-controlled software, like the Tomu: https://tomu.im/ https://tomu.im/

sebazzz 4y ago

That's why you add your Windows computer fingerprint, Apple FaceID from your iPhone, and your Yubikey as authentication methods.