3 ms·

I don’t know about privacy, but the lockout risk doesn’t seem worse than losing your phone or Yubikey. You should have multiple independent ways to log in for a

I don’t know about privacy, but the lockout risk doesn’t seem worse than losing your phone or Yubikey. You should have multiple independent ways to log in for any account you care about. Passkey will be one way. Possibly two ways, if you have both Android and iOS devices and you register both? (I assume Android and iOS remain independent.)

dotancohen 4y ago
So if passkey is just yet another way to log in, then all the security aspects are moot, no? The attacker could still attack the other login methods. E.g., even if the passkey is a secure surface, it does not replace the insecure attack surfaces.
- pas 4y ago
  ideally the site requires 2FA for those, or sends a confirmation email and makes you wait a few hours, etc.
clnq 4y ago
What if one loses all their devices in a natural disaster, a house fire, or burglary, or lost baggage while traveling? A password is in your head. If you lose that, there's not much use for the said password. But otherwise, it's secure. And it's pretty secure from an infosec perspective if it's a passphrase.
- ChancyChance 4y ago
  1Password literally asks you to print out your private key. Yet their hygiene is lauded.
- skybrian 4y ago
  I think it's more likely that you'll lose your password by forgetting it? People forget many things without losing their heads. There's no perfect solution. Having a printout of backup codes in a fireproof safe is pretty good, but it's of no use while traveling. A Yubikey is good, but it might not work (wrong USB port) and it's a device that could break. Having multiple ways to log in reduces your risk of lockout, but also makes it more likely that someone unauthorized could get access.
  - clnq 4y ago
    Passwords, particularly passphrases, are easy to remember and you can reuse a similar structure for probably decades: - There-are-three-ducklings3-in-the-lake - There-are-five-swans5-in-the-lake - There-are-six-hedgehogs6-in-the-bush And so on. You only need to remember the latest number and animal, but the entropy of the whole string is much higher unless someone also knows your personal password structure (which is kind of like a second factor). With a password manager, you only need to remember that one passphrase. If you have to enter it daily, I think it’s very difficult to forget. You can access your passwords mostly independently from any device and it’s probably about as secure if good generated password hygiene on websites and services is used.
    - skybrian 4y ago
      Well okay, but now you depend on a password manager. Hope you picked the right one and backed it up? I’m not sure this is better than using a device to log in.
      - clnq 4y ago
        You are right, choosing the right one (reading its whitepaper and what encryption it uses where), and backups are very important for those. I suppose logging into all of the services we use these days is complicated and not very secure no matter the method.

dotancohen 4y ago

So if passkey is just yet another way to log in, then all the security aspects are moot, no? The attacker could still attack the other login methods. E.g., even if the passkey is a secure surface, it does not replace the insecure attack surfaces.

pas 4y ago
ideally the site requires 2FA for those, or sends a confirmation email and makes you wait a few hours, etc.

clnq 4y ago

What if one loses all their devices in a natural disaster, a house fire, or burglary, or lost baggage while traveling? A password is in your head. If you lose that, there's not much use for the said password. But otherwise, it's secure. And it's pretty secure from an infosec perspective if it's a passphrase.

ChancyChance 4y ago
1Password literally asks you to print out your private key. Yet their hygiene is lauded.
skybrian 4y ago
I think it's more likely that you'll lose your password by forgetting it? People forget many things without losing their heads. There's no perfect solution. Having a printout of backup codes in a fireproof safe is pretty good, but it's of no use while traveling. A Yubikey is good, but it might not work (wrong USB port) and it's a device that could break. Having multiple ways to log in reduces your risk of lockout, but also makes it more likely that someone unauthorized could get access.
- clnq 4y ago
  Passwords, particularly passphrases, are easy to remember and you can reuse a similar structure for probably decades: - There-are-three-ducklings3-in-the-lake - There-are-five-swans5-in-the-lake - There-are-six-hedgehogs6-in-the-bush And so on. You only need to remember the latest number and animal, but the entropy of the whole string is much higher unless someone also knows your personal password structure (which is kind of like a second factor). With a password manager, you only need to remember that one passphrase. If you have to enter it daily, I think it’s very difficult to forget. You can access your passwords mostly independently from any device and it’s probably about as secure if good generated password hygiene on websites and services is used.
  - skybrian 4y ago
    Well okay, but now you depend on a password manager. Hope you picked the right one and backed it up? I’m not sure this is better than using a device to log in.
    - clnq 4y ago
      You are right, choosing the right one (reading its whitepaper and what encryption it uses where), and backups are very important for those. I suppose logging into all of the services we use these days is complicated and not very secure no matter the method.