2 ms·
This! While I agree that passkeys need to be as secure as possible to replace (not so secure) passwords, the part about loosing access to your account needs to
by axelthegerman 4y ago
This! While I agree that passkeys need to be as secure as possible to replace (not so secure) passwords, the part about loosing access to your account needs to be solved.
Account recovery is usually the weakest point of any system (e.g. social engineering calling support to reset account access)
I don't have the answer to this, but a single key locked into one device is definitely a strategy for disaster (or doesn't offer much additional security when still paired with passwords)
- toomuchtodo 4y agoYou can use Stripe Identity or similar to government credential proof someone for about $2 per proofing request. High level, you want to bind IRL identity to digital identity (passkeys) when you have high identity assurance. https://stripe.com/identity https://stripe.com/identity https://pages.nist.gov/sp800-63a.html https://pages.nist.gov/sp800-63a.html Let’s assume crypto proofing is insufficient (because people lose their cryptographic primitives, secure authenticators, and recovery codes), and US digital identity is still playing catch-up to the developed world (I assume one day login.gov, the USPS, and other trust anchors will be able to attest to who you are). Therefore, having a commercial identity proofing provider providing account recovery seems like the optimal solution. (management of customer digital identity is a component of my work at a fintech)
- postalrat 4y agoInstead of passwords many security keys have a pin or biometric that can replace the password. The main advantage is that access is that they are made difficult or impossible to brute force.
- paulryanrogers 4y agoYou still need a recovery mechanism, if not another device then it's usually a password like secret or code.