3 ms·

This was always driving me crazy about webauthn, that you couldn't sync it between devices. You always had to add at least a few devices, not to lose access if

by andix 3y ago

This was always driving me crazy about webauthn, that you couldn't sync it between devices. You always had to add at least a few devices, not to lose access if you lose a device. And keep track of all services, so you can add new devices if you change them. Not very practical. I try always to disable email or SMS 2FA/recovery, because I deem them to be rather unsafe. Btw Bitwarden announced to support pass keys soon ("in October").

yencabulator 3y ago
Hardware keys don't want to transfer the private key out of the hardware gadget, because that compromises the security model. That's their whole point, you can't extract the secrets, the hardware would rather self-destruct than expose the secret. Lack of "sync" (while retaining ease of transferring the key between computers) is the the primary purpose of a hardware security key. You're opting to a lower security level by wanting something that can be synced.
- shepherdjerred 3y ago
  > You're opting to a lower security level by wanting something that can be synced. I don't think most users care
  - andix 3y ago
    I do care about security, but if I lose my yubikey and i can't backup it, then I need to keep some (insecure) account recovery options enabled. If I can backup my passkeys, then I can disable them.
    - simon1573 3y ago
      Yubikey advise you to buy two keys and keep one with you and one in a safe space, only used for recovery. That requires the service you use it on to allow multiple keys though, and that’s unfortunately not always the case.
      - andix 3y ago
        But you always need the second one to set it up for each service. It's fine if you do that for two or three services. But my password manager has around 600 entries. If I would need to set up all of them on both keys and always switch the active one with the one in the safe location for setting up a new account I would go crazy. Having both of them in the same place kind of defeats the purpose of having two keys, as you would lose them together. So better have a synced password manager and unlock the password manager with a hardware key.

by andix 3y ago

yencabulator 3y ago

Hardware keys don't want to transfer the private key out of the hardware gadget, because that compromises the security model. That's their whole point, you can't extract the secrets, the hardware would rather self-destruct than expose the secret. Lack of "sync" (while retaining ease of transferring the key between computers) is the the primary purpose of a hardware security key. You're opting to a lower security level by wanting something that can be synced.

shepherdjerred 3y ago
> You're opting to a lower security level by wanting something that can be synced. I don't think most users care
- andix 3y ago
  I do care about security, but if I lose my yubikey and i can't backup it, then I need to keep some (insecure) account recovery options enabled. If I can backup my passkeys, then I can disable them.
  - simon1573 3y ago
    Yubikey advise you to buy two keys and keep one with you and one in a safe space, only used for recovery. That requires the service you use it on to allow multiple keys though, and that’s unfortunately not always the case.
    - andix 3y ago
      But you always need the second one to set it up for each service. It's fine if you do that for two or three services. But my password manager has around 600 entries. If I would need to set up all of them on both keys and always switch the active one with the one in the safe location for setting up a new account I would go crazy. Having both of them in the same place kind of defeats the purpose of having two keys, as you would lose them together. So better have a synced password manager and unlock the password manager with a hardware key.