3 ms·

The limit to one of physical device is an advantage not they major problem. Exporting means copies can be made. Copies means someone else can own my key without

The limit to one of physical device is an advantage not they major problem. Exporting means copies can be made. Copies means someone else can own my key without my knowledge.

paulryanrogers 4y ago
It's a huge trade-off and arguably one whose countermeasures are too burdensome for normal users. Folks will get locked out when they lose their device. So they'll end up back to secret questions (a slightly more human friendly password), backup codes (also easily lost passwords), or have to buy and grant access to another device for every service. Also requires sites and services actually accept another -- or weaker -- device/secret as a backup. IMO Passkeys are dead unless both services and device makers can automate adding another device easily, securely, and for all active services at once. Otherwise their benefits are too small and costs too large to justify broad and indefinite support.
- axelthegerman 4y ago
  This! While I agree that passkeys need to be as secure as possible to replace (not so secure) passwords, the part about loosing access to your account needs to be solved. Account recovery is usually the weakest point of any system (e.g. social engineering calling support to reset account access) I don't have the answer to this, but a single key locked into one device is definitely a strategy for disaster (or doesn't offer much additional security when still paired with passwords)
  - toomuchtodo 4y ago
    You can use Stripe Identity or similar to government credential proof someone for about $2 per proofing request. High level, you want to bind IRL identity to digital identity (passkeys) when you have high identity assurance. https://stripe.com/identity https://stripe.com/identity https://pages.nist.gov/sp800-63a.html https://pages.nist.gov/sp800-63a.html Let’s assume crypto proofing is insufficient (because people lose their cryptographic primitives, secure authenticators, and recovery codes), and US digital identity is still playing catch-up to the developed world (I assume one day login.gov, the USPS, and other trust anchors will be able to attest to who you are). Therefore, having a commercial identity proofing provider providing account recovery seems like the optimal solution. (management of customer digital identity is a component of my work at a fintech)
  - postalrat 4y ago
    Instead of passwords many security keys have a pin or biometric that can replace the password. The main advantage is that access is that they are made difficult or impossible to brute force.
    - paulryanrogers 4y ago
      You still need a recovery mechanism, if not another device then it's usually a password like secret or code.
- postalrat 4y ago
  You do realize you can use the same devices for as many services as you want. You don't need to "buy and grant access to another device for every service". Have a couple devices. Your phone, security key, etc and use at least 2 for every service you use.
  - paulryanrogers 4y ago
    I meant you have to have more than one device so there's a backup, or else rely on alternative means to recover. Not that every service needs its own device. And if one needs a backup device then one must also register both with every new service.
eviks 4y ago
It's an advantage in one area, but a major problem in another

The limit to one of physical device is an advantage not they major problem. Exporting means copies can be made. Copies means someone else can own my key without my knowledge.

paulryanrogers 4y ago

It's a huge trade-off and arguably one whose countermeasures are too burdensome for normal users. Folks will get locked out when they lose their device. So they'll end up back to secret questions (a slightly more human friendly password), backup codes (also easily lost passwords), or have to buy and grant access to another device for every service. Also requires sites and services actually accept another -- or weaker -- device/secret as a backup. IMO Passkeys are dead unless both services and device makers can automate adding another device easily, securely, and for all active services at once. Otherwise their benefits are too small and costs too large to justify broad and indefinite support.

axelthegerman 4y ago
This! While I agree that passkeys need to be as secure as possible to replace (not so secure) passwords, the part about loosing access to your account needs to be solved. Account recovery is usually the weakest point of any system (e.g. social engineering calling support to reset account access) I don't have the answer to this, but a single key locked into one device is definitely a strategy for disaster (or doesn't offer much additional security when still paired with passwords)
- toomuchtodo 4y ago
  You can use Stripe Identity or similar to government credential proof someone for about $2 per proofing request. High level, you want to bind IRL identity to digital identity (passkeys) when you have high identity assurance. https://stripe.com/identity https://stripe.com/identity https://pages.nist.gov/sp800-63a.html https://pages.nist.gov/sp800-63a.html Let’s assume crypto proofing is insufficient (because people lose their cryptographic primitives, secure authenticators, and recovery codes), and US digital identity is still playing catch-up to the developed world (I assume one day login.gov, the USPS, and other trust anchors will be able to attest to who you are). Therefore, having a commercial identity proofing provider providing account recovery seems like the optimal solution. (management of customer digital identity is a component of my work at a fintech)
- postalrat 4y ago
  Instead of passwords many security keys have a pin or biometric that can replace the password. The main advantage is that access is that they are made difficult or impossible to brute force.
  - paulryanrogers 4y ago
    You still need a recovery mechanism, if not another device then it's usually a password like secret or code.
postalrat 4y ago
You do realize you can use the same devices for as many services as you want. You don't need to "buy and grant access to another device for every service". Have a couple devices. Your phone, security key, etc and use at least 2 for every service you use.
- paulryanrogers 4y ago
  I meant you have to have more than one device so there's a backup, or else rely on alternative means to recover. Not that every service needs its own device. And if one needs a backup device then one must also register both with every new service.

eviks 4y ago

It's an advantage in one area, but a major problem in another