3 ms·
Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. https://support.apple.com/en-au/HT213305#:~:text=Rec
by lll-o-lll 4y ago
Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. https://support.apple.com/en-au/HT213305#:~:text=Recovery%20security&text=Passkeys%20can%20be%20recovered%20through,and%20other%20data%20it%20contains https://support.apple.com/en-au/HT213305#:~:text=Recovery%20....
Should you trust Apple? Is this secure enough if a password can still be used that recovers all these keys?
Ultimately there is always a convenience/security trade-off. The “passkey” concept has it right for the 99% of users case (in my opinion). For that 1%, it’s still WebAuthn, so nothing stops you from using a Yubikey with a second safe-held Yubikey for disaster recovery.
- donmcronald 4y ago> Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. That means single device users are in for a bad time if they lose their device.
- lll-o-lll 4y agoIncorrect. They get a new phone, login with their password and all their keys are downloaded to the new device.
- donmcronald 4y agoI’m guessing that means there’s some kind of key derivation happening which means it’s super similar to modern password managers IMO. I realize there are some benefits, but in a password based world I can memorize my highest value passwords and salt others with a common password. I don’t see the value in making such a big change for such little gain.