5 ms·

Phones are fragile and get lost, stolen, or destroyed. I need a security system for which I am able to make an offline backup.

lolsowrong 3y ago
Google’s implementation allows multiple passkeys. I have a passkey for my iPhone, one from Windows Hello, and 3 from different yubikeys I’ve picked up over the years. The yubikey implementation requires setting a PIN, so I’m not even really worried about one of them being lost of stolen.
- wg0 3y ago
  Cloud you please elaborate in detail how someone not using Yubi keys should adopt it by having hardware keys and how much keys should one have? How Keys are different than an OTP app like Authy?
  - themagician 3y ago
    The Apple security model for Apple ID and iCloud already works like this. Every device is effectively a “passkey” even if they don’t call it that. Been that way for a while now. Every device (except accessories like AppleTV, HomePod, etc.) you log into iCloud with effectively has Super Admin control over your entire iCloud account. Any logged-in device can remove, modify, or change (almost) anything without a password… including the account password (hence the almost). Once authorized, that access is controlled by biometrics with a backup PIN. As long as you maintain control of a single device you have access to everything. Yubikeys work the same way. Doubly so when dealing with resident credentials and passkeys. Key as as many as possible—just make sure the PIN is not obvious. If you hold the key and know the PIN, you can do anything. No other information is needed. The big difference between this and OTP is two fold: 1) much more resistant against phishing; and 2) the underlying key is less likely (or impossible-ish) to be exposed. Phishing a 2FA OTP is actually not hard with a good fake UI. It just requires someone to act quickly on the other end or a good script that can quickly change the password/security settings once a password and OTP are successfully phished.
eptcyka 3y ago
Easy, buy a backup phone, rest easy and boost the economy.
jupp0r 3y ago
What's wrong with an online backup? Offline backups are tied to their physical representation and can get lost in disasters for example. Spread your risk.
- Topgamer7 3y ago
  Moreso about providing the capability to roll your own backup. Online backups an be foiled if they only provide gdrive backup for example.
- LeoPanthera 3y ago
  > What's wrong with an online backup? If Google decides you have Done A Bad, suddenly you can't login to anything, anywhere.
  - jupp0r 3y ago
    That's like saying that all food is unhealthy because of McDonalds.
- fbdab103 3y ago
  Online backup stuck inside Google's walls is the opposite of spreading my risk. An offline backup I can control, I can put in a safe for my relatives in case I die unexpectedly. Or I am robbed. Or any number of foreseeable circumstances where the physical manifestation of my secret is lost.
  - SebastianKra 3y ago
    AFAIK, you can use a physical key anywhere you can use a passkey [1]. And you can register multiple passkeys. So it would be perfectly possible to have your logins in a safe somewhere while having additional passkeys for daily use. You just need create the backup manually for each account provider. You can't extract all your passkeys from a device. But for me, the online-backup provides enough redundancy. In order to be locked out, I'd have to loose all my devices and, at the same time, be banned by my cloud provider. [1] at least that's what the Safari-UI suggests.
userbinator 3y ago
TOTP keys, written down, would probably be ideal for that.
- lelandbatey 3y ago
  TOTP written down does work well, but the parent and I are both interested in how we should write down (on paper, like by printing) the various secrets necessary to reconstruct our passkeys in an emergency. Once that's known, I'll gladly adopt passkeys.
dv_dt 3y ago
A lot of people in the world only have one primary digital device - a phone. If that phone breaks, or is lost or stolen, how do those users get back access to their keys? Will the store holders like Google and Apple validate their identity w/ personal information frequently stolen from credit agencies and healthcare industry data stores?

lolsowrong 3y ago

Google’s implementation allows multiple passkeys. I have a passkey for my iPhone, one from Windows Hello, and 3 from different yubikeys I’ve picked up over the years. The yubikey implementation requires setting a PIN, so I’m not even really worried about one of them being lost of stolen.

wg0 3y ago
Cloud you please elaborate in detail how someone not using Yubi keys should adopt it by having hardware keys and how much keys should one have? How Keys are different than an OTP app like Authy?
- themagician 3y ago
  The Apple security model for Apple ID and iCloud already works like this. Every device is effectively a “passkey” even if they don’t call it that. Been that way for a while now. Every device (except accessories like AppleTV, HomePod, etc.) you log into iCloud with effectively has Super Admin control over your entire iCloud account. Any logged-in device can remove, modify, or change (almost) anything without a password… including the account password (hence the almost). Once authorized, that access is controlled by biometrics with a backup PIN. As long as you maintain control of a single device you have access to everything. Yubikeys work the same way. Doubly so when dealing with resident credentials and passkeys. Key as as many as possible—just make sure the PIN is not obvious. If you hold the key and know the PIN, you can do anything. No other information is needed. The big difference between this and OTP is two fold: 1) much more resistant against phishing; and 2) the underlying key is less likely (or impossible-ish) to be exposed. Phishing a 2FA OTP is actually not hard with a good fake UI. It just requires someone to act quickly on the other end or a good script that can quickly change the password/security settings once a password and OTP are successfully phished.

eptcyka 3y ago

Easy, buy a backup phone, rest easy and boost the economy.

jupp0r 3y ago

What's wrong with an online backup? Offline backups are tied to their physical representation and can get lost in disasters for example. Spread your risk.

Topgamer7 3y ago
Moreso about providing the capability to roll your own backup. Online backups an be foiled if they only provide gdrive backup for example.
LeoPanthera 3y ago
> What's wrong with an online backup? If Google decides you have Done A Bad, suddenly you can't login to anything, anywhere.
- jupp0r 3y ago
  That's like saying that all food is unhealthy because of McDonalds.
fbdab103 3y ago
Online backup stuck inside Google's walls is the opposite of spreading my risk. An offline backup I can control, I can put in a safe for my relatives in case I die unexpectedly. Or I am robbed. Or any number of foreseeable circumstances where the physical manifestation of my secret is lost.
- SebastianKra 3y ago
  AFAIK, you can use a physical key anywhere you can use a passkey [1]. And you can register multiple passkeys. So it would be perfectly possible to have your logins in a safe somewhere while having additional passkeys for daily use. You just need create the backup manually for each account provider. You can't extract all your passkeys from a device. But for me, the online-backup provides enough redundancy. In order to be locked out, I'd have to loose all my devices and, at the same time, be banned by my cloud provider. [1] at least that's what the Safari-UI suggests.

userbinator 3y ago

TOTP keys, written down, would probably be ideal for that.

lelandbatey 3y ago
TOTP written down does work well, but the parent and I are both interested in how we should write down (on paper, like by printing) the various secrets necessary to reconstruct our passkeys in an emergency. Once that's known, I'll gladly adopt passkeys.

dv_dt 3y ago

A lot of people in the world only have one primary digital device - a phone. If that phone breaks, or is lost or stolen, how do those users get back access to their keys? Will the store holders like Google and Apple validate their identity w/ personal information frequently stolen from credit agencies and healthcare industry data stores?