4 ms·
iCloud syncing already has this problem though. If I lose an iPhone and I buy a new iPhone and sign into an iCloud account, my passkeys will get synced. So I'm
by danShumway 3y ago
iCloud syncing already has this problem though. If I lose an iPhone and I buy a new iPhone and sign into an iCloud account, my passkeys will get synced.
So I'm not sure I believe that really strong stances on potential phishing attacks are the real reason here. Passkeys with cloud sync are phishable.
> why bother
A single master password would still be a massive increase in security and would still eliminate a ton of phishing attacks. The cool parts of passkey aren't really the biometrics, the cool parts are how they get shared with websites. That's where the real phishing protection comes from.
- rootusrootus 3y ago> If I lose an iPhone and I buy a new iPhone and sign into an iCloud account Have you done that recently? What a godforsaken pain in the ass it is, especially if you don't have another Apple device handy that you are already signed in to.
- danShumway 3y agoIt has been a fairly long while since I've needed to sync an iCloud account to a new computer. I'm mainly going off of https://support.apple.com/en-us/HT204974 https://support.apple.com/en-us/HT204974 so it definitely could be oversimplifying the requirements. Though even ignoring SMS and recovery codes, I'm not sure that using a second Apple device as 2FA would change anything; we generally don't consider one-time codes to be unphishable. But again, that's only me looking at the docs. Is there something I'm missing about the process that would block a phisher from using an iCloud password plus an SMS hijacking attack or phished one-time code to log in and set one of their devices as trusted?
- lxgr 3y agoIsn’t an SMS-OTP as well as your old device’s unlock code enough?