6 ms·
Apple opened up OS integration for other applications. 1Password is currently doing beta testing of their Passkey implementation. Besides that, the whole idea
by microtonal 3y ago
Apple opened up OS integration for other applications. 1Password is currently doing beta testing of their Passkey implementation.
Besides that, the whole idea of Passkey (in contrast to what this blog claims) was that the key material can be synced between devices, so I am not sure how only the phone would be 'a passkey'. iCloud Keychain syncs my Passkeys between all my devices, including to my MacBooks.
- katbyte 3y agoare there many places that use passkey yet? i've not encountered one, or rather not seen a place to make use of it
- tiltowait 3y agoThis website has a list of sites allegedly supporting passkeys: https://passkeys.directory https://passkeys.directory I say "allegedly", because a few of them (Paypal, eBay, a couple others) have never once offered to let me use a passkey. Sites I know, off the top of my head (because I used them in the past 24 hours): * Porkbun * Google * GitHub (if you enable the preview feature) I know I've used more, but I don't have an easy way of searching for them.
- dcow 3y agoeBay and Paypal do, though I don't know how to get it to prompt you to configure a passkey...
- wkat4242 3y agoPayPal only started offering it two weeks so so that's probably why. Ebay I don't know, haven't used that in many years
- katbyte 3y agothanks, do have an account at a couple listed there so might have to give it a try on an unimportant one
- jabbany 3y agoThe problem with cloud-sync-based managers like the iCloud Keychain is bootstrapping. Since you need to be able to log in to the services themselves to provision access to the passwords. This makes travelling a bit risky, since it's not that hard to lose/break/have your devices stolen during a random trip. This makes it immensely hard to recover, since you cannot just hop onto a public terminal and authenticate (which might involve entering 2FA codes etc that you cannot get anymore). This is why physical tokens are still quite useful. They're rather unattractive to thieves, don't require its own Internet connection to work, and they're relatively small and cheap so you can get a bunch them to stuff in various places increasing your chances of having one still available to you.
- froggit 3y ago"It's easy to lose devices when you travel so just get a shit ton of devices. If you're a big enough of a fuckup to lose them all then you've got bigger life problems anyway." I like good advice that, upon hearing it, seems obvious enough it can be misinterpreted as a dig at one's competence. I'm much more likely to follow it and get my ass saved (I'm the kind of medium grade fuckup that would lose all but one of them).
- thrashh 3y agoKnowing ahead of that problem, you can plan a solution though? Everything I have is cloud-synced and even if I lose my phone right now in a random country, I definitely know how I can recover all my 2FA tokens and logins from a random terminal (or preferably a new boxed phone) -- I DO have to remember some passcodes which I otherwise never use but that's not too hard. If Google or Apple implements this, they can design a solution too.
- jabbany 3y ago> I DO have to remember some passcodes which I otherwise never use but that's not too hard. Right, but you're giving up a lot of security to do this, since it implies with these rare passcodes someone else could also bootstrap your logins. With HW tokens, you don't have to worry about recovery passcodes being leaked/hacked (the recommended procedure today is to print out the recovery codes and destroy digital copies).