4 ms·

Phones don't act as authenticators for FIDO2 yet AFAIK. You usually have either a separate hardware dongle or the OS implements passkeys (WebAuthn in software),

by pabs3 4y ago

Phones don't act as authenticators for FIDO2 yet AFAIK. You usually have either a separate hardware dongle or the OS implements passkeys (WebAuthn in software), which are cloud synced. The way to deal with losing an authenticator is you have multiple of them, including several backups, one in your home safe, one at your friend's place etc.

lll-o-lll 4y ago
No, they do now. Both iOS and Android have full support. Look up “passkey” for more info. Basically, google, apple, MS, etc etc are all supporting this tech now. The recovery process is defined for both Apple and google, as is the device transfer process. Here’s a google post explaining their recovery process: https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html?m=1 https://security.googleblog.com/2022/10/SecurityofPasskeysin...
timwis 4y ago
But then you have to make sure you're home when you setup any new online account (so you can go into your safe and add your backup key to it), or remember to do so when you get home :/
saltcured 4y ago
This new passkey stuff adds use of your phone as an authenticator with a laptop or other system via bluetooth with (unfortunate) cloud-mediation. Before that, some phones could already offer their embedded security chip as a U2F authenticator with the browser app. E.g. I setup the Titan chip in my Pixel 5a as another authenticator with a Google account. But, it only works with a browser on the phone itself. Since the phone browser can also access a Yubikey, I could use the Titan chip to enroll a new Yubikey or vice versa. I do wish there was a standalone "security key" USB mode I could select alongside file transfer, picture transfer, tethering, or charge-only. Then, I could more reasonably use the phone's embedded security chip as a redundant U2F key for many different services I would normally only access from a PC.

by pabs3 4y ago

lll-o-lll 4y ago

No, they do now. Both iOS and Android have full support. Look up “passkey” for more info. Basically, google, apple, MS, etc etc are all supporting this tech now. The recovery process is defined for both Apple and google, as is the device transfer process. Here’s a google post explaining their recovery process: https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html?m=1 https://security.googleblog.com/2022/10/SecurityofPasskeysin...

timwis 4y ago

But then you have to make sure you're home when you setup any new online account (so you can go into your safe and add your backup key to it), or remember to do so when you get home :/

saltcured 4y ago

This new passkey stuff adds use of your phone as an authenticator with a laptop or other system via bluetooth with (unfortunate) cloud-mediation. Before that, some phones could already offer their embedded security chip as a U2F authenticator with the browser app. E.g. I setup the Titan chip in my Pixel 5a as another authenticator with a Google account. But, it only works with a browser on the phone itself. Since the phone browser can also access a Yubikey, I could use the Titan chip to enroll a new Yubikey or vice versa. I do wish there was a standalone "security key" USB mode I could select alongside file transfer, picture transfer, tethering, or charge-only. Then, I could more reasonably use the phone's embedded security chip as a redundant U2F key for many different services I would normally only access from a PC.