6 ms·

Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the

Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.” Can we please stop the bandwagon for a moment and inquire about the downsides of Passkey?

fragmede 3y ago
How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?
- hooverd 3y ago
  You don't.
- jabbany 3y ago
  Recovery code system? Like 2FA today, generate a special bootstrap key you can print and save. This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)
  - recursive_loops 3y ago
    > generate a special bootstrap key you can print and save So ... a password? Also in this scenario you've been robbed. It's quite possible that either they took your printed out passkey also since it was in your wallet, or you're not at home where you can get the pass key from your file cabinet or safe.
    - jabbany 3y ago
      Not really. A password is meant to be memorized and reproduced correctly regularlt, whereas a recovery key doesn't need that and can be very long and complicated since it is rarely used.
- hotpotamus 3y ago
  Probably easier to start a new life at that point.
jabbany 3y ago
Technologically there's nothing really bad about them (imagine a managed version of ssh keypairs). Technically they could even be backed by physical devices like Yubikeys and never touch the cloud. My worry is the actual implementation, where platforms might lock you into their cloud as the sole provider simply by not implementing interoperability...

fragmede 3y ago

How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?

hooverd 3y ago
You don't.
jabbany 3y ago
Recovery code system? Like 2FA today, generate a special bootstrap key you can print and save. This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)
- recursive_loops 3y ago
  > generate a special bootstrap key you can print and save So ... a password? Also in this scenario you've been robbed. It's quite possible that either they took your printed out passkey also since it was in your wallet, or you're not at home where you can get the pass key from your file cabinet or safe.
  - jabbany 3y ago
    Not really. A password is meant to be memorized and reproduced correctly regularlt, whereas a recovery key doesn't need that and can be very long and complicated since it is rarely used.
hotpotamus 3y ago
Probably easier to start a new life at that point.

jabbany 3y ago

Technologically there's nothing really bad about them (imagine a managed version of ssh keypairs). Technically they could even be backed by physical devices like Yubikeys and never touch the cloud. My worry is the actual implementation, where platforms might lock you into their cloud as the sole provider simply by not implementing interoperability...