3 ms·
The initial poster described that process - you bring government IDs in person to an office. If you want to avoid that, just set up multiple devices.
by insanitybit 3y ago
The initial poster described that process - you bring government IDs in person to an office.
If you want to avoid that, just set up multiple devices.
- raxxorraxor 3y agoOr use a password. Seriously, you have to do better here. I guess we will see recovery options by a master password and then the mechanism would be the question again.
- insanitybit 3y agoI don't get it, why is a password superior? The argument of "what if you lose access to multiple devices" seems just as valid as the argument of "what if you forget your password". Recovery is the same either way - you need to establish identity somehow, using any number of other mechanisms (such as showing up somewhere with government issued ID).
- 0cf8612b2e1e 3y agoI can make a personal backup of a password. A fragile piece of hardware can fail me for a variety of reasons outside my control(lost or suddenly breaks). I have had a (Google) phone suddenly die in my hands without any prompting. With a password I was able to transition to a new device without incident. If my passkey was locked to that device, I might have found myself locked out of my digital identity.
- insanitybit 3y ago> A fragile piece of hardware can fail me for a variety of reasons outside my control(lost or suddenly breaks). But you can use multiple devices... How is "a password written down and stored somewhere" better than a separate device used for backup purposes? Hell, get three devices, go nuts.
- 0cf8612b2e1e 3y agoThat does not seem like a big burden to the majority of the population? Many people have a single phone. That’s it. Everyone can write down a password without any troubles. This new and improved mechanism requires people to shell out real money for multiple devices just to be safe in case of loss/theft/failure? Let’s not forget the providers who do not offer the ability to enroll multiple devices. Last I heard, AWS would only let you put a single authenticator on your account.
- insanitybit 3y agoAWS is violating the spec and it's an embarrassment tbh Anyway, to be clear, I'm not advocating for "get rid of passwords forever", I'm saying that for a lot of people passkeys are superior and the whole "how do I recover" is just not that big of a deal. The main issue is the cost of devices like yubikeys. They should lower those. Companies should start providing them. Schools should hand them out. etc.
- Liquid_Fire 3y agoIt's free and trivial to backup a password database any number of times. Even storing it with a cloud provider is nearly free, because they are so small. You can even automate verifying that all the backups are accessible and valid. When you create a new account with a new service, your daily backup will pick it up immediately. With passkeys you have to buy multiple phones, sign each of them into every one of your accounts, then keep them physically distributed (no cloud storage for phones). And to make sure they still work you have to periodically manually go and interact with the phones physically, even the one you stored in a bank vault. You also have to do this if you sign up for a new service. Not to mention the inevitable services that don't allow multiple passkeys.
- insanitybit 3y agoPhones? You can buy a yubikey
- 3y ago