2 ms·

I have the opposite concern. The great thing about Yubikeys and other FIDO U2F/FIDO2 keys is they can't be cloned. With Passkeys living on your iOS or Android p

by fmajid 4y ago

I have the opposite concern. The great thing about Yubikeys and other FIDO U2F/FIDO2 keys is they can't be cloned. With Passkeys living on your iOS or Android phone, they are only one successful Pegasus exploit away from being compromised. What is essential is the ability to have multiple credentials associated with an account. Possibly so you have redundant Yubikeys, but also to have an Apple and a Google passkey so you are not locked out if your phone is lost (thanks to Apple's brain-dead decision to allow phone + passcode to reset the recovery key) or if Google decides to close your account on a whim.

josephcsible 4y ago
> What is essential is the ability to have multiple credentials associated with an account. Since not every website will let you do that, even though they should, it's of paramount importance that passkeys can be cloned.
- fmajid 4y ago
  The eternal trade-off between security and availability... Some like Apple actually require a minimum of two FIDO keys before allowing you to turn on hardware key-based 2FA.