5 ms·

> If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired. I think Apple would consider this "working

> If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired. I think Apple would consider this "working as designed."

lozenge 4y ago
With passkeys, now every platform can enjoy this level of lock in!
- rootusrootus 4y ago
  I hope not. I'm patiently waiting on 1Password to release their implementation of passkeys so I can have it work on all my devices, Apple or not.
  - stavros 4y ago
    Yep, same with BitWarden. That would be fantastic.
  - stouset 4y ago
    Just use Passkeys. Any account that allows 2FA allows multiple second factors. You should be setting up backup second factors anyway if you don't want to risk getting permanently locked out of all of your accounts. Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. If you're using strong passwords with 1Password, your second factor is basically only defending against a leak of your password database. If you're storing your second factor in that same password database, what are you gaining?
    - withinboredom 4y ago
      passkeys isn't supported on linux desktop, at all. and if you know how to make it work, please let me know. I have to switch to a Windows machine to login with them.
    - cstrahan 4y ago
      Well, with the exception of AWS, unless something has changed recently — they notoriously only support one second factor (i.e. if you use YubiKeys or similar, you can only use one).
      - stouset 4y ago
        Yeah, AWS is the only exception I've encountered :) But if you have backup second factors (you have backup second factors, right?) and you're worried about Passkey lock-in for whatever reason… just use that other second factor for AWS or any other account which supports only one.
      - JimDabell 4y ago
        You can add multiple MFA devices since November of last year: > Now, you can add multiple MFA devices to AWS account root users and AWS Identity and Access Management (IAM) users in your AWS accounts. This helps you to raise the security bar in your accounts and limit access management to highly privileged principals, such as root users. Previously, you could only have one MFA device associated with root users or IAM users, but now you can associate up to eight MFA devices of the currently supported types with root users and IAM users. — https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul...
    - jorvi 4y ago
      Isn’t the whole point of Passkeys that you can’t ever lose them, since they’re tied to your biometrics..
      - stouset 4y ago
        They're not tied to your biometrics. They're stored inside the TPM of your device, which is unlocked by some form of biometrics. But if you lose all the devices with your passkeys on them, they are gone for good.
    - howinteresting 4y ago
      > Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. Not quite! 1password itself counts as two factors: something you know (the master password), and something you have (the additional secret key). Passkeys in 1password would eliminate phishing as a problem.
    - zarzavat 4y ago
      I’m super curious what a backup second factor is for the average user who has only one device: a phone, that sometimes gets lost or is stolen. Feels like these things are designed by Californians with no idea of how the world is.
      - stouset 4y ago
        If you're in this category, your alternative to Passkeys at all is SMS or no 2FA whatsoever. Enabling Passkeys does at least ensure that you have a minimum of two separate devices so you already do effectively have some form of backup of your second factor. My comment is targeted at someone who is savvy enough to: a) care about having "real" 2FA, and b) is concerned about lock-in, and c) is extremely sensitive to being locked out. For someone like that, you're already buying YubiKeys or some equivalent. And if you don't already have some, you're never prevented from using them later.
      - crooked-v 4y ago
        Reminds of the occasional comment threads on here about homeless people permanently locked out of new accounts every few months because of stolen devices and the growing corporate obsession with forced 2FA, and all the replies that amount to "if they didn't want to fuck off and die they shouldn't have been poor".
- warning26 4y ago
  Yeah, that's why I'd never touch passkeys. It feels like you're basically locking yourself into a weird ecosystem that you'll never be able to escape from.
  - stouset 4y ago
    This is kind of silly. If you're using hardware 2FA, you should absolutely have backups. I've used YubiKeys for years and have one in my laptop, one on a keychain, and one in a safety deposit box. Passkeys are just another instance of this. I have added Passkeys to all of my accounts with 2FA and it's somewhat more convenient (significantly more convenient for mobile devices). But every account also has all my YubiKeys attached as second factors. There is no lock-in. And while it's inconvenient and annoying to have to add multiple keys to every account, that is already the reality if you're responsibly using hardware second factors.
    - devman0 4y ago
      This would be less annoying if we could get actual federated identity that big players would actually accept, as it stands having to fetch a key from a safe deposit box every time I register a new account is a huge amount of friction.
      - stouset 4y ago
        It absolutely is. But that’s a separate problem entirely from “will Passkeys lock me in to the Apple ecosystem”, to which the answer is an unqualified no.
      - jve 4y ago
        Microsoft is a big player and here you go: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/ad-fs-overview https://learn.microsoft.com/en-us/windows-server/identity/ad... I currently have a Microsoft (Work) account that I'm SSO logged on.
        devman0 4y ago
asciii 4y ago
> I think Apple would consider this "working as designed." Incoming iTunes Password Manager, next event :P
WWLink 4y ago
> I think Apple would consider this "working as designed." Punishing us geeks who like using multiple different kinds of OS on their phones and computers. :(
OsintOtter69 4y ago
[flagged]

> If you are 100% Mac then it's a good product. Going outside of the walled Apple garden leaves a lot to be desired. I think Apple would consider this "working as designed."

lozenge 4y ago

With passkeys, now every platform can enjoy this level of lock in!

rootusrootus 4y ago
I hope not. I'm patiently waiting on 1Password to release their implementation of passkeys so I can have it work on all my devices, Apple or not.
- stavros 4y ago
  Yep, same with BitWarden. That would be fantastic.
- stouset 4y ago
  Just use Passkeys. Any account that allows 2FA allows multiple second factors. You should be setting up backup second factors anyway if you don't want to risk getting permanently locked out of all of your accounts. Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. If you're using strong passwords with 1Password, your second factor is basically only defending against a leak of your password database. If you're storing your second factor in that same password database, what are you gaining?
  - withinboredom 4y ago
    passkeys isn't supported on linux desktop, at all. and if you know how to make it work, please let me know. I have to switch to a Windows machine to login with them.
  - cstrahan 4y ago
    Well, with the exception of AWS, unless something has changed recently — they notoriously only support one second factor (i.e. if you use YubiKeys or similar, you can only use one).
    - stouset 4y ago
      Yeah, AWS is the only exception I've encountered :) But if you have backup second factors (you have backup second factors, right?) and you're worried about Passkey lock-in for whatever reason… just use that other second factor for AWS or any other account which supports only one.
    - JimDabell 4y ago
      You can add multiple MFA devices since November of last year: > Now, you can add multiple MFA devices to AWS account root users and AWS Identity and Access Management (IAM) users in your AWS accounts. This helps you to raise the security bar in your accounts and limit access management to highly privileged principals, such as root users. Previously, you could only have one MFA device associated with root users or IAM users, but now you can associate up to eight MFA devices of the currently supported types with root users and IAM users. — https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul...
  - jorvi 4y ago
    Isn’t the whole point of Passkeys that you can’t ever lose them, since they’re tied to your biometrics..
    - stouset 4y ago
      They're not tied to your biometrics. They're stored inside the TPM of your device, which is unlocked by some form of biometrics. But if you lose all the devices with your passkeys on them, they are gone for good.
  - howinteresting 4y ago
    > Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. Not quite! 1password itself counts as two factors: something you know (the master password), and something you have (the additional secret key). Passkeys in 1password would eliminate phishing as a problem.
  - zarzavat 4y ago
    I’m super curious what a backup second factor is for the average user who has only one device: a phone, that sometimes gets lost or is stolen. Feels like these things are designed by Californians with no idea of how the world is.
    - stouset 4y ago
      If you're in this category, your alternative to Passkeys at all is SMS or no 2FA whatsoever. Enabling Passkeys does at least ensure that you have a minimum of two separate devices so you already do effectively have some form of backup of your second factor. My comment is targeted at someone who is savvy enough to: a) care about having "real" 2FA, and b) is concerned about lock-in, and c) is extremely sensitive to being locked out. For someone like that, you're already buying YubiKeys or some equivalent. And if you don't already have some, you're never prevented from using them later.
    - crooked-v 4y ago
      Reminds of the occasional comment threads on here about homeless people permanently locked out of new accounts every few months because of stolen devices and the growing corporate obsession with forced 2FA, and all the replies that amount to "if they didn't want to fuck off and die they shouldn't have been poor".
warning26 4y ago
Yeah, that's why I'd never touch passkeys. It feels like you're basically locking yourself into a weird ecosystem that you'll never be able to escape from.
- stouset 4y ago
  This is kind of silly. If you're using hardware 2FA, you should absolutely have backups. I've used YubiKeys for years and have one in my laptop, one on a keychain, and one in a safety deposit box. Passkeys are just another instance of this. I have added Passkeys to all of my accounts with 2FA and it's somewhat more convenient (significantly more convenient for mobile devices). But every account also has all my YubiKeys attached as second factors. There is no lock-in. And while it's inconvenient and annoying to have to add multiple keys to every account, that is already the reality if you're responsibly using hardware second factors.
  - devman0 4y ago
    This would be less annoying if we could get actual federated identity that big players would actually accept, as it stands having to fetch a key from a safe deposit box every time I register a new account is a huge amount of friction.
    - stouset 4y ago
      It absolutely is. But that’s a separate problem entirely from “will Passkeys lock me in to the Apple ecosystem”, to which the answer is an unqualified no.
    - jve 4y ago
      Microsoft is a big player and here you go: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/ad-fs-overview https://learn.microsoft.com/en-us/windows-server/identity/ad... I currently have a Microsoft (Work) account that I'm SSO logged on.
      - devman0 4y ago

asciii 4y ago

> I think Apple would consider this "working as designed." Incoming iTunes Password Manager, next event :P

WWLink 4y ago

> I think Apple would consider this "working as designed." Punishing us geeks who like using multiple different kinds of OS on their phones and computers. :(

OsintOtter69 4y ago

[flagged]