5 ms·

A web password is effectively a private secret, that can be used, for example, to derive a ECC keypair, but this secret is passed around in plain text between y

A web password is effectively a private secret, that can be used, for example, to derive a ECC keypair, but this secret is passed around in plain text between your device and the target site or service. It might be encrypted on the wire, but it must be known by both. So any system that replaces web auth passwords is, worst case, just as bad as a password from a key-ownership perspective. Such a system also has the potential to be much better than a password, for example your auth secret is only entered on a secure keyboard (thumb reader, etc.) and used locally on a device you own, which then handles all auth tasks.

zarzavat 3y ago
The question is how do you recover it when you lose it? For a password I just click the “I forgot my password” link, I get an email with a link to click, and my account is recovered within minutes. I have recovered 15 year old accounts this way. If you can’t do that with passkeys, then the system is doomed to failure because people lose their credentials and devices all the time.
- cornholio 3y ago
  Surely a system where you have a single point of trust and key backup is better than the current mess of using a single password on multiple sites, like most people do. And no, the solution to that is not security education, people don't change and a system that expects behavioral changes without enforcing them is simply an insecure design. The truth of the matter is that passwords are insecure and problematic for the vast majority of non-technical people.
- dvzk 3y ago
  You authenticate to a cloud escrow provider using any of your account's other associated devices. If you have none, because Yellowstone erupted while you were away, and someone also yoinked your phone in the ensuing chaos, then you input either (A) your device's passcode and an SMS code, or (B) a recovery key. If you have neither, then you use an established recovery contact. If those steps didn't work, then it's not too late to visit Wyoming.

zarzavat 3y ago

The question is how do you recover it when you lose it? For a password I just click the “I forgot my password” link, I get an email with a link to click, and my account is recovered within minutes. I have recovered 15 year old accounts this way. If you can’t do that with passkeys, then the system is doomed to failure because people lose their credentials and devices all the time.

cornholio 3y ago
Surely a system where you have a single point of trust and key backup is better than the current mess of using a single password on multiple sites, like most people do. And no, the solution to that is not security education, people don't change and a system that expects behavioral changes without enforcing them is simply an insecure design. The truth of the matter is that passwords are insecure and problematic for the vast majority of non-technical people.
dvzk 3y ago
You authenticate to a cloud escrow provider using any of your account's other associated devices. If you have none, because Yellowstone erupted while you were away, and someone also yoinked your phone in the ensuing chaos, then you input either (A) your device's passcode and an SMS code, or (B) a recovery key. If you have neither, then you use an established recovery contact. If those steps didn't work, then it's not too late to visit Wyoming.