3 ms·

Also note that password managers generally won’t let you export a copy of your passkeys for offline backup. Until this is fixed, no thank you. Give me a secur

Also note that password managers generally won’t let you export a copy of your passkeys for offline backup. Until this is fixed, no thank you. Give me a secure way to make backups on my own infrastructure without the need to forgo my data sovereignty and disaster recovery dependencies to the likes of Google, Apple, etc.

lxgr 3y ago
Unfortunately that also opens up the tech support scam vector of “Hi, this is your bank, we need you to copy-paste this value for us so we can enhance the security on your account”. I’m not saying that’s the only (or even main) reason Google and Apple don’t let users make their backups, but explicit non-exportability can be considered a feature in some contexts.
- az09mugen 3y ago
  The fact Google and Apple do that (for security reasons) also have the negative impact to de-responsabilize users. Which is also one of the causes of why scams work. If users were more alert of the technologies they're using, there would be less social hacking.
m-p-3 3y ago
One thing that is crucial is that websites MUST support multiple Passkeys per account, otherwise you end up with a single point of failure if something happens to your password manager. It's good that you can't export a Passkey, which reduce the attack vector against phishing and extraction. It's kinda like how an SSH or a GPG private key should never leave the computer it was generated from, and each machine should have their own unique private key.
- syntheticcdo 3y ago
  I ran into the issue earlier when implementing WebAuthn. Realizing that user authentication was tied to a single device/ecosystem, I wanted to allow the user to register a second key -- but because their authentication was tied only to their existing physical authenticator, I had no way to authenticate the second machine without magic email link, or setting a password and logging into the second device, which seems to completely defeat the purpose.

lxgr 3y ago

Unfortunately that also opens up the tech support scam vector of “Hi, this is your bank, we need you to copy-paste this value for us so we can enhance the security on your account”. I’m not saying that’s the only (or even main) reason Google and Apple don’t let users make their backups, but explicit non-exportability can be considered a feature in some contexts.

az09mugen 3y ago
The fact Google and Apple do that (for security reasons) also have the negative impact to de-responsabilize users. Which is also one of the causes of why scams work. If users were more alert of the technologies they're using, there would be less social hacking.

m-p-3 3y ago

One thing that is crucial is that websites MUST support multiple Passkeys per account, otherwise you end up with a single point of failure if something happens to your password manager. It's good that you can't export a Passkey, which reduce the attack vector against phishing and extraction. It's kinda like how an SSH or a GPG private key should never leave the computer it was generated from, and each machine should have their own unique private key.

syntheticcdo 3y ago
I ran into the issue earlier when implementing WebAuthn. Realizing that user authentication was tied to a single device/ecosystem, I wanted to allow the user to register a second key -- but because their authentication was tied only to their existing physical authenticator, I had no way to authenticate the second machine without magic email link, or setting a password and logging into the second device, which seems to completely defeat the purpose.