5 ms·

Little question on that topic Maybe it’s that all this stuff is still new but whenever something offers PassKey support I now add 3: - one on android - one o

Little question on that topic Maybe it’s that all this stuff is still new but whenever something offers PassKey support I now add 3: - one on android - one on iOS - one in 1Password Even more fun when it’s mixed with yubikeys, add primary key and secondary key to that list I now have a spreadsheet to write down which website has which keys added to keep track. Hopefully something like 1Password will handle that soon, but I don’t want to risk losing access to my iCloud or Google and getting locked out. Even more confusing when browsers like chrome offer to save a passkey into the browser which is synced only within that browser (I think, exception being Safari) How are you all handling that?

lxgr 3y ago
For this reason, I don’t really use WebAuthN as my (only) second factor – yet. We’ll soon be able to sync these across platforms using password managers, though. Android already has an API available for them to integrate, I believe; iOS will follow in autumn.
aseipp 3y ago
In the next version of iOS you'll be able to use a third party app to handle the Passkey flow, like how a 3rd party app can handle the password flow today. So you'll be able to remove your passkey from iCloud and use the one inside 1Password instead. Also, I think the browser thing with Chrome is a matter of extension support; in Edge with 1Password Beta Extension, 1Password definitely takes over Passkey flows instead of using the (absolutely insanely confusing) Windows Hello UX. Just like it takes over password saving (there's an option in settings that shows password sync settings are controlled by the 1Pass extension.) So you may just need to use the Beta extension in your Chrome for now, and I think 1Password will take over from there. Basically we're moving towards a setup where you trust your password manager to hold onto your passkeys and then the OS will allow that integration. I don't know what the status of these features are on Android.
- artdigital 3y ago
  Ah that’s good to hear! I use the 1Password beta on Chromium browsers, but obviously that’s a bit awkward when some stuff is saved in Safari, some in 1Password and some elsewhere It’s a bit of a mess right now and even me as an IT person, I sometimes think I have a PassKey saved for something just for it to not work, either because I used the wrong device or because I didn’t actually save one and forgot. Or once I had accepted the prompt to store the PassKey in Arc (or some other Chromium browser) which then didn’t work in another browser when I tried to login
toomuchtodo 3y ago
If I get locked out, I expect the ability to reset my passkeys (stored in iCloud primarily) with an email, just like I would with a password reset. Passkeys are cryptographic primitives replacing password strings, not replacing identity. There is a difference. The Home Depot mobile app does something similar already. Passkeys/biometrics for a persisting an iOS session, and to re-up a session, you get emailed a six digit code to your email. Why have the password? If email as identity as insufficient for your use case, ask the user for a government credential using Stripe Identity or ID.me, or doing a token amount charge on a financial account the user has access to (offloading the identity proofing to their bank) to bring their account back up to a higher assurance level (“IAL”) during an access reset. I recommend recovery contacts if you’re in the Apple ecosystem. Tangentially, setup legacy contacts as well. https://support.apple.com/en-us/HT212513 https://support.apple.com/en-us/HT212513 https://support.apple.com/en-us/HT212515 https://support.apple.com/en-us/HT212515 https://support.apple.com/en-us/HT212360 https://support.apple.com/en-us/HT212360 (customer and corp IAM is a component of my work at a FinTech)
hsbauauvhabzb 3y ago
Google Authenticator decided to nuke all my existing MFA tokens during a recent update/refresh of their app. I can tell you to sort your redundancy now, it’s much easier than later. I can also tell you to avoid google tooling, they seem completely disinterested in support and more interested in market share. Google can go to hell for the time / account access I lost, fuck them.
- isaacremuant 3y ago
  > can also tell you to avoid google tooling, they seem completely disinterested in support and more interested in market share It's been the case for ages. They show absolute disregard for the unique users. All they care about is their pseudo monopolized aggregates.
  - szasamasa 3y ago
    then use microsoft authenticator or bitwarden
    - isaacremuant 3y ago
      Why are you under the impression that I'm not? You may need to pay more attention to what you read, the context and the users before writing.
      - szasamasa 3y ago
        I was under no impression whatsoever. I said if you hate google you have alternatives. Google bashing is lame. I am sure if you have a 10 dollar phone logged in to your google account at home, offline, you never lose your 2fa codes. But hey, arent they just a long key you can import anywhere via QR-code? If you do not trust or you are one of those mysterious people who lose access to the Google account (illegal activities?) then make a copy. All I said was it is irritating this google bashing.
- djbusby 3y ago
  Is it possible to DIY these things? Or a FOSS app on my phone?

lxgr 3y ago

For this reason, I don’t really use WebAuthN as my (only) second factor – yet. We’ll soon be able to sync these across platforms using password managers, though. Android already has an API available for them to integrate, I believe; iOS will follow in autumn.

aseipp 3y ago

In the next version of iOS you'll be able to use a third party app to handle the Passkey flow, like how a 3rd party app can handle the password flow today. So you'll be able to remove your passkey from iCloud and use the one inside 1Password instead. Also, I think the browser thing with Chrome is a matter of extension support; in Edge with 1Password Beta Extension, 1Password definitely takes over Passkey flows instead of using the (absolutely insanely confusing) Windows Hello UX. Just like it takes over password saving (there's an option in settings that shows password sync settings are controlled by the 1Pass extension.) So you may just need to use the Beta extension in your Chrome for now, and I think 1Password will take over from there. Basically we're moving towards a setup where you trust your password manager to hold onto your passkeys and then the OS will allow that integration. I don't know what the status of these features are on Android.

artdigital 3y ago
Ah that’s good to hear! I use the 1Password beta on Chromium browsers, but obviously that’s a bit awkward when some stuff is saved in Safari, some in 1Password and some elsewhere It’s a bit of a mess right now and even me as an IT person, I sometimes think I have a PassKey saved for something just for it to not work, either because I used the wrong device or because I didn’t actually save one and forgot. Or once I had accepted the prompt to store the PassKey in Arc (or some other Chromium browser) which then didn’t work in another browser when I tried to login

toomuchtodo 3y ago

If I get locked out, I expect the ability to reset my passkeys (stored in iCloud primarily) with an email, just like I would with a password reset. Passkeys are cryptographic primitives replacing password strings, not replacing identity. There is a difference. The Home Depot mobile app does something similar already. Passkeys/biometrics for a persisting an iOS session, and to re-up a session, you get emailed a six digit code to your email. Why have the password? If email as identity as insufficient for your use case, ask the user for a government credential using Stripe Identity or ID.me, or doing a token amount charge on a financial account the user has access to (offloading the identity proofing to their bank) to bring their account back up to a higher assurance level (“IAL”) during an access reset. I recommend recovery contacts if you’re in the Apple ecosystem. Tangentially, setup legacy contacts as well. https://support.apple.com/en-us/HT212513 https://support.apple.com/en-us/HT212513 https://support.apple.com/en-us/HT212515 https://support.apple.com/en-us/HT212515 https://support.apple.com/en-us/HT212360 https://support.apple.com/en-us/HT212360 (customer and corp IAM is a component of my work at a FinTech)

hsbauauvhabzb 3y ago

Google Authenticator decided to nuke all my existing MFA tokens during a recent update/refresh of their app. I can tell you to sort your redundancy now, it’s much easier than later. I can also tell you to avoid google tooling, they seem completely disinterested in support and more interested in market share. Google can go to hell for the time / account access I lost, fuck them.

isaacremuant 3y ago
> can also tell you to avoid google tooling, they seem completely disinterested in support and more interested in market share It's been the case for ages. They show absolute disregard for the unique users. All they care about is their pseudo monopolized aggregates.
- szasamasa 3y ago
  then use microsoft authenticator or bitwarden
  - isaacremuant 3y ago
    Why are you under the impression that I'm not? You may need to pay more attention to what you read, the context and the users before writing.
    - szasamasa 3y ago
      I was under no impression whatsoever. I said if you hate google you have alternatives. Google bashing is lame. I am sure if you have a 10 dollar phone logged in to your google account at home, offline, you never lose your 2fa codes. But hey, arent they just a long key you can import anywhere via QR-code? If you do not trust or you are one of those mysterious people who lose access to the Google account (illegal activities?) then make a copy. All I said was it is irritating this google bashing.
djbusby 3y ago
Is it possible to DIY these things? Or a FOSS app on my phone?