3 ms·

Passkeys follow the 3-2-1 backup rule, just like any other digital data. The main difference being that you don't need to backup the passkey itself, just have m

Passkeys follow the 3-2-1 backup rule, just like any other digital data. The main difference being that you don't need to backup the passkey itself, just have multiple passkeys. Have 3 passkeys 2 of them on-person at any time (e.g. one on your phone TPM, one on a Yubikey) 1 of them off-site (e.g. keep a backup Yubikey at home in a fireproof safe, or use a 1Password passkey, depending on your threat model) Whenever you sign up for a new vendor/service, register all three passkeys with your account.

radlad 3y ago
... or just store a password in your password manager. I thought passkeys were supposed to be convenient to use.
stouset 3y ago
I do follow this. Unfortunately, it leaves out one glaring flaw: you can’t register a Passkey you don’t physically have. I use four: an Apple Passkey, a YubiKey I keep on me, a YubiKey at home, and a YubiKey in the bank. When I sign up for a service, I need to register all four of them. Not only is this generally a bit of a pain in the ass, but it also means I have to remember to go fetch the one in the bank vault periodically and update the credentials. If I could save a stub locally that would let me register with a key not in my physical presence, that would go a long way to making this more usable. Even better would be the ability to register a bundle of them all in one go without having to do it four separate times. As it stands right now, it’s hard to recommend to users who don’t understand or care enough to take all of these steps. Which to be clear is entirely reasonable on their part. It’s an unacceptable amount of work and mental accounting for it to be something the average person can do without high risk of losing their entire digital identity.
- solatic 3y ago
  > I have to remember to go fetch the one in the bank vault periodically I feel you, but I don't think Average Joe's threat model requires keeping a Yubikey in a safe deposit box (this is besides the issue that safe deposit boxes are less safe than you think: https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html https://www.nytimes.com/2019/07/19/business/safe-deposit-box... ). A cloud-based passkey (like 1Password) is fine as the off-site backup key for most people.
  - stouset 3y ago
    > A cloud-based passkey (like 1Password) is fine as the off-site backup key for most people. You're probably right, but this is still new enough that I'm nervous to rely on that. If 1Password has a data-corruption incident and you don't have other passkeys, there goes your digital identity. 1Password (or Apple Keychain) plus two YubiKeys is almost certainly fine. But that does still now run into the pain of registering multiple passkeys. To be completely honest, I sometimes wonder if it's borderline malpractice that sites allow registering only a single Passkey. Registration processes should fundamentally require you to onboard two of them at a minimum, and encourage three. Or maybe I'm just becoming curmudgeonly as I get older. But I do worry that the current state of things—while absolutely on the right track—is going to be an unfolding disaster for non-savvy early adopters.
- swores 3y ago
  > "glaring flaw: you can’t register a Passkey you don’t physically have." I have Yubikeys and find this frustrating. Is there not a technical solution that should've happened by now, or is it not as simple as I'm imagining: can't hardware passkeys have a way to export whatever it is that's needed for services to register them (public key/s?) such that if you have 4 keys you can export 4 files to your PC and and time you create an online account just provide all four files at the same time to be registered? I guess maybe it's not as simple as being a public key that can be registered without the key being around, some sort of active challenge/response needed as part of registration? Or is my imagined solution above completely workable and just overlooked so far?
JohnFen 3y ago
> Whenever you sign up for a new vendor/service, register all three passkeys with your account. That's exactly the part that makes this solution unworkable.
mwwaters 3y ago
I will say that for Google's Advanced Protection, I was convinced having a recovery phone added was okay. I just have a hardware key on my key chain and one on a pretty fireproof safe (which I got for other reasons). But I still added a phone recovery just in case. As I understand it, the recovery process will always wait multiple days while sending many emails to me that it's been initiated.

radlad 3y ago

... or just store a password in your password manager. I thought passkeys were supposed to be convenient to use.

stouset 3y ago

I do follow this. Unfortunately, it leaves out one glaring flaw: you can’t register a Passkey you don’t physically have. I use four: an Apple Passkey, a YubiKey I keep on me, a YubiKey at home, and a YubiKey in the bank. When I sign up for a service, I need to register all four of them. Not only is this generally a bit of a pain in the ass, but it also means I have to remember to go fetch the one in the bank vault periodically and update the credentials. If I could save a stub locally that would let me register with a key not in my physical presence, that would go a long way to making this more usable. Even better would be the ability to register a bundle of them all in one go without having to do it four separate times. As it stands right now, it’s hard to recommend to users who don’t understand or care enough to take all of these steps. Which to be clear is entirely reasonable on their part. It’s an unacceptable amount of work and mental accounting for it to be something the average person can do without high risk of losing their entire digital identity.

solatic 3y ago
> I have to remember to go fetch the one in the bank vault periodically I feel you, but I don't think Average Joe's threat model requires keeping a Yubikey in a safe deposit box (this is besides the issue that safe deposit boxes are less safe than you think: https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html https://www.nytimes.com/2019/07/19/business/safe-deposit-box... ). A cloud-based passkey (like 1Password) is fine as the off-site backup key for most people.
- stouset 3y ago
  > A cloud-based passkey (like 1Password) is fine as the off-site backup key for most people. You're probably right, but this is still new enough that I'm nervous to rely on that. If 1Password has a data-corruption incident and you don't have other passkeys, there goes your digital identity. 1Password (or Apple Keychain) plus two YubiKeys is almost certainly fine. But that does still now run into the pain of registering multiple passkeys. To be completely honest, I sometimes wonder if it's borderline malpractice that sites allow registering only a single Passkey. Registration processes should fundamentally require you to onboard two of them at a minimum, and encourage three. Or maybe I'm just becoming curmudgeonly as I get older. But I do worry that the current state of things—while absolutely on the right track—is going to be an unfolding disaster for non-savvy early adopters.
swores 3y ago
> "glaring flaw: you can’t register a Passkey you don’t physically have." I have Yubikeys and find this frustrating. Is there not a technical solution that should've happened by now, or is it not as simple as I'm imagining: can't hardware passkeys have a way to export whatever it is that's needed for services to register them (public key/s?) such that if you have 4 keys you can export 4 files to your PC and and time you create an online account just provide all four files at the same time to be registered? I guess maybe it's not as simple as being a public key that can be registered without the key being around, some sort of active challenge/response needed as part of registration? Or is my imagined solution above completely workable and just overlooked so far?

JohnFen 3y ago

> Whenever you sign up for a new vendor/service, register all three passkeys with your account. That's exactly the part that makes this solution unworkable.

mwwaters 3y ago

I will say that for Google's Advanced Protection, I was convinced having a recovery phone added was okay. I just have a hardware key on my key chain and one on a pretty fireproof safe (which I got for other reasons). But I still added a phone recovery just in case. As I understand it, the recovery process will always wait multiple days while sending many emails to me that it's been initiated.