3 ms·

> they can't actually authenticate anywhere with just a public key Duh, obviously. Sorry about that stupid statement. Yes, public keys are more secure. However

> they can't actually authenticate anywhere with just a public key Duh, obviously. Sorry about that stupid statement. Yes, public keys are more secure. However, that doesn't matter, because: > use iCloud Keychain as your password manager This is exactly the thing that is a total non-starter. A proprietary, closed-source third-party service that can go offline at any time? I would maybe trust that with my hackernews login and that's about it. Not even reddit. > once while two devices are online together This is also still a non-starter. What happens when you are traveling with only one device, and lose or break it? I simply buy a new phone, go get the USB drive with all my passwords on it from the hotel safe, connect it to the phone, and I'm back in business. What do you do with passkeys?

WorldMaker 3y ago
> This is exactly the thing that is a total non-starter. A proprietary, closed-source third-party service that can go offline at any time? There will be open-source options eventually. Certainly, the wheels are spinning among some of the HN sorts that think about such things. Apple and Google (and Microsoft) have a head start because they have to coalition build on these standards to make them work, but it is all still based on standards (all of FIDO2, WebAuthn). But in the context of "just save the randomly generated password in your browser's password manager", the big 3 cover the majority of average users' browsers, so the UX should in theory be simple for the average user, not just the technically proficient user (nor the "I only trust open source" user). Firefox is, of course, working on their passkey tools as well. > What happens when you are traveling with only one device, and lose or break it? The same recovery process that happens for your primary account on the device, your Apple iCloud account or Google Account. That part isn't changing in all of this. Those are closed source so whatever details for how they already today escrow recovery keys for scenarios like that where no other device is available to bootstrap recovery from. Though once bootstrapped from a recovery state, all the passkeys should flow to the new device just as all the passwords in the password manager and you are back in business. Recommending owning at least two Apple devices connected to your account is already common security recommendation going back several years now because of Apple's E2E guarantees when you do so. That's not new guidance unique to their passkeys implementation, but also a cornerstone of existing Apple ecosystem security.

WorldMaker 3y ago

> This is exactly the thing that is a total non-starter. A proprietary, closed-source third-party service that can go offline at any time? There will be open-source options eventually. Certainly, the wheels are spinning among some of the HN sorts that think about such things. Apple and Google (and Microsoft) have a head start because they have to coalition build on these standards to make them work, but it is all still based on standards (all of FIDO2, WebAuthn). But in the context of "just save the randomly generated password in your browser's password manager", the big 3 cover the majority of average users' browsers, so the UX should in theory be simple for the average user, not just the technically proficient user (nor the "I only trust open source" user). Firefox is, of course, working on their passkey tools as well. > What happens when you are traveling with only one device, and lose or break it? The same recovery process that happens for your primary account on the device, your Apple iCloud account or Google Account. That part isn't changing in all of this. Those are closed source so whatever details for how they already today escrow recovery keys for scenarios like that where no other device is available to bootstrap recovery from. Though once bootstrapped from a recovery state, all the passkeys should flow to the new device just as all the passwords in the password manager and you are back in business. Recommending owning at least two Apple devices connected to your account is already common security recommendation going back several years now because of Apple's E2E guarantees when you do so. That's not new guidance unique to their passkeys implementation, but also a cornerstone of existing Apple ecosystem security.