3 ms·

> Passkeys are already device-bound No, they're explicitly not, they're synced to the cloud for both iOS and Android. Microsoft also plans to do cloud sync (if

> Passkeys are already device-bound No, they're explicitly not, they're synced to the cloud for both iOS and Android. Microsoft also plans to do cloud sync (if they don't already). Yubikeys are device identity credentials. Passkeys are user credentials, they get backed up off device. That's a really big deal that both Google and Apple have been heavily advertising about their implementations -- you make a passkey on your phone, lose your phone, buy a new phone, and you get your passkey back when you sign into your account. They are very much user credentials rather than device credentials; anyone who has access to your iCloud can use your passkeys. Passkeys aren't bound to your iPhone, but they are inexplicably bound to your Apple devices. That's the portability problem. The major companies (Google, Microsoft, Apple) got rid of device-bound keys. But they kept the platform lock-in. > where almost certainly, a user HAS MANY devices. Speak for yourself, I have exactly one device that will work as an authenticator, and even it only works as an authenticator because I've been too lazy to install LineageOS on it. Most people own one phone and a laptop, and they frequently travel with both of them at the same time. I think Google/Microsoft/Apple went the cloud-sync direction partially in acknowledgement of the fact that "use multiple devices" doesn't really work for everyone.

derefr 3y ago
> Passkeys are bigger than that, they're not device bound. That's a really big deal that both Google and Apple have been advertising about their implementations -- you make a passkey on your phone, lose your phone, buy a new phone, and you get your passkey back. You're interpreting "device" differently than I am, here. Maybe let me use a different word. There's a physical hardware device (the device's "body") and then there's a particular installation of an OS (the device's "soul.") Unlike humans, these device "souls" can leave and come back (restoring from backup) or be reincarnated into a different body (transferring a backup to a new hardware device.) What Apple, Google, etc. are claiming is that passkey credentials are bound to the soul of your device — the unique installation session that resulted in a unique product-key "activation" in their servers — rather than to the body of your device. So wherever the installation goes, the passkeys go along with it. But this does not mean that passkeys are portable between installations. They still inherently represent "devices" — just semantic, abstract devices, that may be incarnated at any given time in zero or one physical hardware devices. And, again, this is exactly how Apple's and Google's own device enrolment for sign-in to their respective cloud accounts works. I have devices listed in my iCloud account that currently have no "incarnated" form — the hardware was wiped, sold, and is now being used by someone else! — but those unique installations do still "exist" and could be "reincarnated", as long as I keep my iCloud Backup of them.
- danShumway 3y ago
  > There's a physical hardware device (the device's "body") and then there's a particular installation of an OS (the device's "soul.") This is an interesting theory of device uniqueness that would be potentially cool to build a service around, but it is inaccurate to how passkeys are implemented. iCloud sync is cross-device; if you make a passkey on your iOS device, it gets synced to your Mac. You can also share them with other iOS devices that aren't even linked to your iCloud account using Airdrop. They're very separate from the OS or "instance" of your device's software. And in fact, you actually can't use platform authentication in Safari unless you sign into an iCloud account to sync your keys. Not only is it not tied to the "soul" of the device, you're not allowed to tie it to the soul of the device. Apple requires you to tie it to your account.

derefr 3y ago

> Passkeys are bigger than that, they're not device bound. That's a really big deal that both Google and Apple have been advertising about their implementations -- you make a passkey on your phone, lose your phone, buy a new phone, and you get your passkey back. You're interpreting "device" differently than I am, here. Maybe let me use a different word. There's a physical hardware device (the device's "body") and then there's a particular installation of an OS (the device's "soul.") Unlike humans, these device "souls" can leave and come back (restoring from backup) or be reincarnated into a different body (transferring a backup to a new hardware device.) What Apple, Google, etc. are claiming is that passkey credentials are bound to the soul of your device — the unique installation session that resulted in a unique product-key "activation" in their servers — rather than to the body of your device. So wherever the installation goes, the passkeys go along with it. But this does not mean that passkeys are portable between installations. They still inherently represent "devices" — just semantic, abstract devices, that may be incarnated at any given time in zero or one physical hardware devices. And, again, this is exactly how Apple's and Google's own device enrolment for sign-in to their respective cloud accounts works. I have devices listed in my iCloud account that currently have no "incarnated" form — the hardware was wiped, sold, and is now being used by someone else! — but those unique installations do still "exist" and could be "reincarnated", as long as I keep my iCloud Backup of them.

danShumway 3y ago
> There's a physical hardware device (the device's "body") and then there's a particular installation of an OS (the device's "soul.") This is an interesting theory of device uniqueness that would be potentially cool to build a service around, but it is inaccurate to how passkeys are implemented. iCloud sync is cross-device; if you make a passkey on your iOS device, it gets synced to your Mac. You can also share them with other iOS devices that aren't even linked to your iCloud account using Airdrop. They're very separate from the OS or "instance" of your device's software. And in fact, you actually can't use platform authentication in Safari unless you sign into an iCloud account to sync your keys. Not only is it not tied to the "soul" of the device, you're not allowed to tie it to the soul of the device. Apple requires you to tie it to your account.