3 ms·
If you lose your keys, you can replace them pretty easily. The mental model for doing so is pretty simple and doesn't require contacting tens or hundreds of web
by AlexandrB 4y ago
If you lose your keys, you can replace them pretty easily. The mental model for doing so is pretty simple and doesn't require contacting tens or hundreds of websites.
I'm pretty skeptical that passkeys are going to yield much benefit. Websites will still have to maintain a "recovery" flow for the reason above and this is already the weakest link a lot of the time.
- nixpulvis 4y agoMaybe think of the "recovery" flow as authentication itself and the passkey as a cache of the most recent valid check. Put you passkey manager under the same umbrella as your "recovery", or sync you passkeys through another service you trust. Under this model, new authentication pretty much should always leaves a paper trail, while passkey login, could be more like the "remember me" cookie from the old days. Sorry for the tangent, but has anyone ever heard anything about cross-device cookie synchronization?
- stavros 4y agoIn its core, WebAuthn is a way for a site to say "I want to authenticate" and the browser/device to say "OK, here are my credentials". Nothing is stopping you from generating a private key from a password that you have in your head, and using that to authenticate to every site. Obviously, if that password gets stolen, the thief can get into any of your accounts, but that's a choice you have to make. WebAuthn doesn't mandate a specific way of storing credentials.