13 ms·

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Some apps/sites try to do something cleverer, e.g. requiring additional factors to reset (MFA), or appointing a "trusted contact" user who can confirm your password reset, or asking "security questions" that only you know the answer to. Those apps/sites would put you through the same process to reset your passkey. "How do I reset my password when I forget it" is an infamous balancing act between user friendliness and strict security. The "reset my passkey" problem is exactly as hard, no easier and no harder, as the "reset my password" problem. (Of course, it's possible to have a site that has no way to reset your password, and just assumes that you'll never forget your password. Similarly, those sites could have no way to reset your passkey. In that case, the problem is as you say: there'd be no way to recover your keys if you lost access to them.)

hartator 3y ago
> Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Sounds like email based login with extra steps then.
NikolaNovak 3y ago
>>So, how do you reset your password when you forget it? Well, it depends. But I don't! I can write a password in any amount of low and high tech ways! I have them printed on paper in safe deposit box (my wife is bad with passwords, so this is safety if I should perish:), I have them in a password manager on USB sticks at home in a safe, I have them copied on my NAS and laptop and so on. Whereas passkeys, it seems from everywhere I read to be far more fragile, far more locked in to specific perishable hardware device and a specific vendor ecosystem, and very limited or no ways to handle passkeys in a low tech way or as a file/artifact to be backed up. Basically they assume I live on and with my phone. To put it bluntly: Passwords are something I can use if I show up naked at a stranger's house. They can be with me in and through an emergency (physical emergencies exist! Computer geeks forget about those!). Or more commonly, I can use them to check my email or comms if I forget my phone at a friend's house. Passkeys are... strictly worse?
- stavros 3y ago
  You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco...
  - masfuerte 3y ago
    That's really helpful. Do you know of an open source passkey client?
    - stavros 3y ago
      Someone has linked a few implementations in the thread here: https://news.ycombinator.com/item?id=36238001 https://news.ycombinator.com/item?id=36238001
  - brookst 3y ago
    Thank you. It is disheartening that so many HN readers would rather imagine how passkeys work, and freak out at their own imaginings, than just learn the real thing.
    - stavros 3y ago
      Yep, that's what frustrates me as well, especially for a technology that will be a massive gift to both security and usability.
      - barbazoo 3y ago
        Have a look around this thread. Lots of smart people having difficulties figuring out how this works. This is a bad sign. It shouldn't be this hard to figure out the basics.
        3y ago
raxxorraxor 3y ago
Not really sure if that is really cleverer to be honest. I think passwords and the common password reset via capability URL is pretty fine. I use stronger credentials for banking and everything else is pretty much only protected by password. I also do cherish the privacy advantages of not using a login provider. I had accounts suspended for no reason and this dependency is just not acceptable. Even banking with device bound credentials is a hassle everytime you switch devices or you picked up the wrong phone. I have some apps using login with Microsoft because users are logged in anyway in a corporate environment and it is practical to provide SSO. Here accounts might also be closed and access needs to withdrawn. Practical to do so centrally. But for cleverness I still believe nothing beats a secret in your head. Quick, fast, secure. Oauth is a mess, so I doubt passwords will be outdated anytime soon.
zoomTo125 3y ago
Thank you. I think this answers my question.
jjav 3y ago
> (Of course, it's possible to have a site that has no way to reset your password, and just assumes that you'll never forget your password. Similarly, those sites could have no way to reset your passkey. In that case, the problem is as you say: there'd be no way to recover your keys if you lost access to them.) Isn't this the catch though (I haven't been following passkey work much)? Every site knows users will absolutely forget passwords, so having a reset mechanism is a must. But I can imagine many sites thinking nobody will forget a passkey since it doesn't need to be remembered, thus hardcoding it in ways that make reset impractical.
- drdaeman 3y ago
  There's more. Password recovery means that you're changing your password. Every single password reset flow does what it says on the tin - resets your password. After it's complete, old password is gone, account has a new password. This is logical. For Passkeys, going through the recovery flow may indicate two possible things: 1) that you lost the Passkey and going through the recovery to replace it with a new one; or 2) that you merely want to log in on a different device where the original Passkey is not available. This, of course, is going to work in practice - much worse designs had worked after all. But it's all logically unsound, and not really addressed by standard bodies or large implementers. It's not a big deal and there are ways to make it logical - but because it's not addressed it's gonna be a mess.
PhilipRoman 3y ago
The email password reset feature is an overlooked part of modern security. It has become sort of like a master key for every service. Combined with password reuse it becomes really risky (but oh, so convenient).
- drdaeman 3y ago
  This approach basically makes all the security provided by the passkeys void, as the whole system becomes no better than login-via-email-link or login-via-SMS-code scheme.
  - fshbbdssbbgdd 3y ago
    Every time an average user registers to a site with a passkey, they aren’t giving that their reused password that also provides access to their email (I believe that’s the main way email accounts get hacked). If they registered to their email with a passkey, great. Either way, passkeys seem to reduce the risk of the email being compromised.
    - drdaeman 3y ago
      I don't think password reuse is the common vector - I believe the most common one is phishing, where user is tricked into giving up their current credentials, straight for the service that attacker is interested in. But I can be wrong. And, yeah, it is an improvement for sure. You're definitely right that passkeys drastically improve the bottom line security for the least protected folks (which are probably the majority). It is a step in the right direction, for sure. But they also make things worse for me - someone who uses different random high-entropy passwords for almost everything except local sudo and unlock PIN codes. I want to use PKI instead of shared secrets, but when I try - it's extremely inconvenient, so I know at some point I'll just give up. This, and the fact that my bottom line is not moving up at all - it still remains the same, limited by recovery processes' security - is frustrating.
makeitdouble 3y ago
I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. I use a password manager with a full backup of the vault, so the answer to most of the parent's question would be solved by getting the vault back from backup. Except: - passkeys are not yet supported by my password manager, so I'd have to wait for a while - can I move Safari's passkeys to my password managers afterwards, like I did with passwords ? probably not ? - can I move my password manager's passkeys to another one if I need to ? I have no idea. That's where, at least for me, none of this is simpler than I think. The same way reset passwords is an absolute last ditch effort, I hope passkeys can be managed without having to get back to the service every time we change how we want to manage access on our side.
- dzikimarian 3y ago
  You can set up as many as you want, so just register your phone as one and your PC as other. Eg. using Windows Hello. If you loose or compromise one device, you just delete it as a passkey - rest is still working. If you loose all of them at the same time somehow, there's usually fall back to password or some kind of reset process.
  - NikolaNovak 3y ago
    For every account thought, correct? Like, I can keep all my passwords in a password manager. And then copy and replicate that database however I want to. With passkeys, I'd need to set up and authenticate additional devices... for every of hundreds of accounts I have? Am I wrong? Like if I have an android tablet and iPhone and windows PC and a Linux PC (as I do) that's half a dozen setups for each and every account? And this is a good thing??
    - MilaM 3y ago
      It's my understanding that passkeys that are created by platform authenticators or password managers can be backed up. That's how replicating your key through iCloud likely works. Hardware keys on the other hand don't support backups by design. You need to enroll multiple keys to have a backup. > With passkeys, I'd need to set up and authenticate additional devices This is true, if you don't use a platform authenticator or password manager and only use hardware keys.
kahnclusions 3y ago
How do I access my e-mail to reset my passkey when it's also protected by passkey?
- Technotroll 3y ago
  I had this problem with Dashlane after they suddenly changed their policies, though with a regular password. My solution? Out of frustration I developed my own password manager. Eventually I was able to recover the password from my email provider though. But at that point I had no more nails left.
  - ayewo 3y ago
    > I had this problem with Dashlane after they suddenly changed their policies, This is a bit hard to know what to search on. Where can I read more about the policy changes?
    - Technotroll 3y ago
      Sorry, I can't remember. They suddenly lowered the amount of clients a few years ago. This locked me out of my e-mail client. Since 2FA updates were sent to my e-mail it lead to a bit of tail-biting. Pretty much the same problem can happen with a passkey. Either way this blew away a lot of the trust I used to have in password managers, so out of frustration I coded my own as a backup that can digest Dashlane output so I never need to rely only on them ever again.
  - dicytea 3y ago
    I had the same issue with LastPass a few years ago. When I reinstalled my OS they decided to lock me out of my account because they thought I was a different person. The only way through is e-mail verification. Guess where that email's password was stored in? Lost everything. Been using Bitwarden ever since.
    - ursuscamp 3y ago
      Everyone must know two passwords: their password manager's password, and their email password.

hartator 3y ago

> Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Sounds like email based login with extra steps then.

NikolaNovak 3y ago

>>So, how do you reset your password when you forget it? Well, it depends. But I don't! I can write a password in any amount of low and high tech ways! I have them printed on paper in safe deposit box (my wife is bad with passwords, so this is safety if I should perish:), I have them in a password manager on USB sticks at home in a safe, I have them copied on my NAS and laptop and so on. Whereas passkeys, it seems from everywhere I read to be far more fragile, far more locked in to specific perishable hardware device and a specific vendor ecosystem, and very limited or no ways to handle passkeys in a low tech way or as a file/artifact to be backed up. Basically they assume I live on and with my phone. To put it bluntly: Passwords are something I can use if I show up naked at a stranger's house. They can be with me in and through an emergency (physical emergencies exist! Computer geeks forget about those!). Or more commonly, I can use them to check my email or comms if I forget my phone at a friend's house. Passkeys are... strictly worse?

stavros 3y ago
You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco...
- masfuerte 3y ago
  That's really helpful. Do you know of an open source passkey client?
  - stavros 3y ago
    Someone has linked a few implementations in the thread here: https://news.ycombinator.com/item?id=36238001 https://news.ycombinator.com/item?id=36238001
- brookst 3y ago
  Thank you. It is disheartening that so many HN readers would rather imagine how passkeys work, and freak out at their own imaginings, than just learn the real thing.
  - stavros 3y ago
    Yep, that's what frustrates me as well, especially for a technology that will be a massive gift to both security and usability.
    - barbazoo 3y ago
      Have a look around this thread. Lots of smart people having difficulties figuring out how this works. This is a bad sign. It shouldn't be this hard to figure out the basics.
      - 3y ago

raxxorraxor 3y ago

Not really sure if that is really cleverer to be honest. I think passwords and the common password reset via capability URL is pretty fine. I use stronger credentials for banking and everything else is pretty much only protected by password. I also do cherish the privacy advantages of not using a login provider. I had accounts suspended for no reason and this dependency is just not acceptable. Even banking with device bound credentials is a hassle everytime you switch devices or you picked up the wrong phone. I have some apps using login with Microsoft because users are logged in anyway in a corporate environment and it is practical to provide SSO. Here accounts might also be closed and access needs to withdrawn. Practical to do so centrally. But for cleverness I still believe nothing beats a secret in your head. Quick, fast, secure. Oauth is a mess, so I doubt passwords will be outdated anytime soon.

zoomTo125 3y ago

Thank you. I think this answers my question.

jjav 3y ago

> (Of course, it's possible to have a site that has no way to reset your password, and just assumes that you'll never forget your password. Similarly, those sites could have no way to reset your passkey. In that case, the problem is as you say: there'd be no way to recover your keys if you lost access to them.) Isn't this the catch though (I haven't been following passkey work much)? Every site knows users will absolutely forget passwords, so having a reset mechanism is a must. But I can imagine many sites thinking nobody will forget a passkey since it doesn't need to be remembered, thus hardcoding it in ways that make reset impractical.

drdaeman 3y ago
There's more. Password recovery means that you're changing your password. Every single password reset flow does what it says on the tin - resets your password. After it's complete, old password is gone, account has a new password. This is logical. For Passkeys, going through the recovery flow may indicate two possible things: 1) that you lost the Passkey and going through the recovery to replace it with a new one; or 2) that you merely want to log in on a different device where the original Passkey is not available. This, of course, is going to work in practice - much worse designs had worked after all. But it's all logically unsound, and not really addressed by standard bodies or large implementers. It's not a big deal and there are ways to make it logical - but because it's not addressed it's gonna be a mess.

PhilipRoman 3y ago

The email password reset feature is an overlooked part of modern security. It has become sort of like a master key for every service. Combined with password reuse it becomes really risky (but oh, so convenient).

drdaeman 3y ago
This approach basically makes all the security provided by the passkeys void, as the whole system becomes no better than login-via-email-link or login-via-SMS-code scheme.
- fshbbdssbbgdd 3y ago
  Every time an average user registers to a site with a passkey, they aren’t giving that their reused password that also provides access to their email (I believe that’s the main way email accounts get hacked). If they registered to their email with a passkey, great. Either way, passkeys seem to reduce the risk of the email being compromised.
  - drdaeman 3y ago
    I don't think password reuse is the common vector - I believe the most common one is phishing, where user is tricked into giving up their current credentials, straight for the service that attacker is interested in. But I can be wrong. And, yeah, it is an improvement for sure. You're definitely right that passkeys drastically improve the bottom line security for the least protected folks (which are probably the majority). It is a step in the right direction, for sure. But they also make things worse for me - someone who uses different random high-entropy passwords for almost everything except local sudo and unlock PIN codes. I want to use PKI instead of shared secrets, but when I try - it's extremely inconvenient, so I know at some point I'll just give up. This, and the fact that my bottom line is not moving up at all - it still remains the same, limited by recovery processes' security - is frustrating.

makeitdouble 3y ago

I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. I use a password manager with a full backup of the vault, so the answer to most of the parent's question would be solved by getting the vault back from backup. Except: - passkeys are not yet supported by my password manager, so I'd have to wait for a while - can I move Safari's passkeys to my password managers afterwards, like I did with passwords ? probably not ? - can I move my password manager's passkeys to another one if I need to ? I have no idea. That's where, at least for me, none of this is simpler than I think. The same way reset passwords is an absolute last ditch effort, I hope passkeys can be managed without having to get back to the service every time we change how we want to manage access on our side.

dzikimarian 3y ago
You can set up as many as you want, so just register your phone as one and your PC as other. Eg. using Windows Hello. If you loose or compromise one device, you just delete it as a passkey - rest is still working. If you loose all of them at the same time somehow, there's usually fall back to password or some kind of reset process.
- NikolaNovak 3y ago
  For every account thought, correct? Like, I can keep all my passwords in a password manager. And then copy and replicate that database however I want to. With passkeys, I'd need to set up and authenticate additional devices... for every of hundreds of accounts I have? Am I wrong? Like if I have an android tablet and iPhone and windows PC and a Linux PC (as I do) that's half a dozen setups for each and every account? And this is a good thing??
  - MilaM 3y ago
    It's my understanding that passkeys that are created by platform authenticators or password managers can be backed up. That's how replicating your key through iCloud likely works. Hardware keys on the other hand don't support backups by design. You need to enroll multiple keys to have a backup. > With passkeys, I'd need to set up and authenticate additional devices This is true, if you don't use a platform authenticator or password manager and only use hardware keys.

kahnclusions 3y ago

How do I access my e-mail to reset my passkey when it's also protected by passkey?

Technotroll 3y ago
I had this problem with Dashlane after they suddenly changed their policies, though with a regular password. My solution? Out of frustration I developed my own password manager. Eventually I was able to recover the password from my email provider though. But at that point I had no more nails left.
- ayewo 3y ago
  > I had this problem with Dashlane after they suddenly changed their policies, This is a bit hard to know what to search on. Where can I read more about the policy changes?
  - Technotroll 3y ago
    Sorry, I can't remember. They suddenly lowered the amount of clients a few years ago. This locked me out of my e-mail client. Since 2FA updates were sent to my e-mail it lead to a bit of tail-biting. Pretty much the same problem can happen with a passkey. Either way this blew away a lot of the trust I used to have in password managers, so out of frustration I coded my own as a backup that can digest Dashlane output so I never need to rely only on them ever again.
- dicytea 3y ago
  I had the same issue with LastPass a few years ago. When I reinstalled my OS they decided to lock me out of my account because they thought I was a different person. The only way through is e-mail verification. Guess where that email's password was stored in? Lost everything. Been using Bitwarden ever since.
  - ursuscamp 3y ago
    Everyone must know two passwords: their password manager's password, and their email password.