7 ms·

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, simila

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?

smileybarry 4y ago
I wonder how iCloud shutdown would affect this route, but: your Passkeys are synced to your devices locally, and the whole "scan QR code on another device with your phone to authenticate" flow is fully local, utilizing key authentication over BLE. Theoretically, your Passkeys should still be on your iPhone/iPad/Mac/iThing, and QR authentication will work. (And then you provision another key on another device, since Passkeys' intention is like SSH keys, allowing multiple on a single account)
echeese 4y ago
Probably the same thing that happens when you forget your password. Hit the "forgot your password" link, get a confirmation email, create a new passkey
WorldMaker 4y ago
Just like TOTP (used for most 2FA) the best practice for websites accepting passkeys will be to support as many passkeys as you wish to enroll. So you could enroll into your account some device associated with your Apple ID and some device associated with your Microsoft Account and some device associated with your Google Account and some browser associated with your Firefox Account and use any of those for recovery. Unlike TOTP, the base case for passkeys is multiple key enrollment so websites are more likely to support it well whereas with TOTP so many implement it as having one-and-only-one TOTP configured. Even when enrolling just a single device that device generally enrolls a small key-chain, not just a single key, because that's how recovery systems work even for using just a single "owner" account. Plus most people use 2 or more devices regularly and Passkey has to work with that. So much more websites in practice should actually support N passkeys where N > 1 (versus half-baked single-option-only TOTP implementations). At least in theory, in practice we'll see how well Passkey gets implemented at large, there's always lots of ways for companies to get practice wrong.
- secabeen 4y ago
  Best practice is unlikely to help here, as people just aren't going to register passkeys from multiple services unless it happens automatically. I might bother to enroll multiple passkeys for my bank, but I'm unlikely to do it often. Are Passkeys exportable and re-importable by another service, site, or system? As described above, if my Google Account is terminated by Google without recourse (which absolutely happens), do I lose access to all sites that I used solely a Google Account Passkey for once my phone stops working?
  - WorldMaker 4y ago
    It should start to happen automatically. Apple, Google, and Microsoft have all stated the goal that they are hoping for deep inter-operation across all of a user's devices, regardless of ecosystem. If you are truly paranoid that your major device accounts are subject to termination without recourse (which if that happens you generally have lots of other problems and should maybe cause you to rethink your other trust relationships with such vendors and which devices you are buying), you can build your own Passkeys with WebAuthn standards and roll your own recovery/backup strategy. (Most FIDO compatible WebAuthn keys already work today anywhere Passkeys are supported, Passkey is just the "brand name" for those standards plus a soon-to-be-standard Bluetooth LTE handshake plus Vendor-guided backup and recovery plus whatever cross-device ecosystem "interop" standards the Big 3 eventually settle on.)
    - secabeen 4y ago
      > It should start to happen automatically. Apple, Google, and Microsoft have all stated the goal that they are hoping for deep inter-operation across all of a user's devices, regardless of ecosystem. If this is the case, then maybe there will be some solution through Google Takeout. Apple and MS seem less interested in this, but if one of them can generate an export, I can see services appearing that can work with that exported data. > you can build your own Passkeys with WebAuthn standards and roll your own recovery/backup strategy. This....or I can stick with passwords, print them out annually and put them in my fire safe. The KISS principle works here, and I can't imagine a non-techie person who works in a socially-risky field being able to do so. > If you are truly paranoid that your major device accounts are subject to termination without recourse (which if that happens you generally have lots of other problems and should maybe cause you to rethink your other trust relationships with such vendors and which devices you are buying) Complaints by users who have Big 3 cloud accounts closed for unspecified "violations" are common enough to make it a concern. I take other protections against something like this, but I absolutely do consider it a risk, and would generally advise people not to keep all their digital services under one roof. If you use Gmail for email, then use Microsoft or Apple for Passkey, Bitwarden or 1Password for Password Vaults, etc., etc.
selykg 4y ago
> Or Apple decides to shut down your iCloud? This is probably testable as it is. They sync to iCloud Keychain, as is my understanding anyway. How are the rest of your passwords stored in iCloud Keychain when your account is hosed? Do you lose those or does it just turn off syncing? I'd imagine it turns off syncing but keeps the keychain around unless you delete the iCloud Account from the device. That's a whole different ballgame of potential bad decisions though.

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?

smileybarry 4y ago

I wonder how iCloud shutdown would affect this route, but: your Passkeys are synced to your devices locally, and the whole "scan QR code on another device with your phone to authenticate" flow is fully local, utilizing key authentication over BLE. Theoretically, your Passkeys should still be on your iPhone/iPad/Mac/iThing, and QR authentication will work. (And then you provision another key on another device, since Passkeys' intention is like SSH keys, allowing multiple on a single account)

echeese 4y ago

Probably the same thing that happens when you forget your password. Hit the "forgot your password" link, get a confirmation email, create a new passkey

WorldMaker 4y ago

Just like TOTP (used for most 2FA) the best practice for websites accepting passkeys will be to support as many passkeys as you wish to enroll. So you could enroll into your account some device associated with your Apple ID and some device associated with your Microsoft Account and some device associated with your Google Account and some browser associated with your Firefox Account and use any of those for recovery. Unlike TOTP, the base case for passkeys is multiple key enrollment so websites are more likely to support it well whereas with TOTP so many implement it as having one-and-only-one TOTP configured. Even when enrolling just a single device that device generally enrolls a small key-chain, not just a single key, because that's how recovery systems work even for using just a single "owner" account. Plus most people use 2 or more devices regularly and Passkey has to work with that. So much more websites in practice should actually support N passkeys where N > 1 (versus half-baked single-option-only TOTP implementations). At least in theory, in practice we'll see how well Passkey gets implemented at large, there's always lots of ways for companies to get practice wrong.

secabeen 4y ago
Best practice is unlikely to help here, as people just aren't going to register passkeys from multiple services unless it happens automatically. I might bother to enroll multiple passkeys for my bank, but I'm unlikely to do it often. Are Passkeys exportable and re-importable by another service, site, or system? As described above, if my Google Account is terminated by Google without recourse (which absolutely happens), do I lose access to all sites that I used solely a Google Account Passkey for once my phone stops working?
- WorldMaker 4y ago
  It should start to happen automatically. Apple, Google, and Microsoft have all stated the goal that they are hoping for deep inter-operation across all of a user's devices, regardless of ecosystem. If you are truly paranoid that your major device accounts are subject to termination without recourse (which if that happens you generally have lots of other problems and should maybe cause you to rethink your other trust relationships with such vendors and which devices you are buying), you can build your own Passkeys with WebAuthn standards and roll your own recovery/backup strategy. (Most FIDO compatible WebAuthn keys already work today anywhere Passkeys are supported, Passkey is just the "brand name" for those standards plus a soon-to-be-standard Bluetooth LTE handshake plus Vendor-guided backup and recovery plus whatever cross-device ecosystem "interop" standards the Big 3 eventually settle on.)
  - secabeen 4y ago
    > It should start to happen automatically. Apple, Google, and Microsoft have all stated the goal that they are hoping for deep inter-operation across all of a user's devices, regardless of ecosystem. If this is the case, then maybe there will be some solution through Google Takeout. Apple and MS seem less interested in this, but if one of them can generate an export, I can see services appearing that can work with that exported data. > you can build your own Passkeys with WebAuthn standards and roll your own recovery/backup strategy. This....or I can stick with passwords, print them out annually and put them in my fire safe. The KISS principle works here, and I can't imagine a non-techie person who works in a socially-risky field being able to do so. > If you are truly paranoid that your major device accounts are subject to termination without recourse (which if that happens you generally have lots of other problems and should maybe cause you to rethink your other trust relationships with such vendors and which devices you are buying) Complaints by users who have Big 3 cloud accounts closed for unspecified "violations" are common enough to make it a concern. I take other protections against something like this, but I absolutely do consider it a risk, and would generally advise people not to keep all their digital services under one roof. If you use Gmail for email, then use Microsoft or Apple for Passkey, Bitwarden or 1Password for Password Vaults, etc., etc.

selykg 4y ago

> Or Apple decides to shut down your iCloud? This is probably testable as it is. They sync to iCloud Keychain, as is my understanding anyway. How are the rest of your passwords stored in iCloud Keychain when your account is hosed? Do you lose those or does it just turn off syncing? I'd imagine it turns off syncing but keeps the keychain around unless you delete the iCloud Account from the device. That's a whole different ballgame of potential bad decisions though.