3 ms·

From the linked site about FIDO: > Passkeys replace passwords with cryptographic key pairs [...] synced between the user’s devices via a cloud service. [...] s

From the linked site about FIDO: > Passkeys replace passwords with cryptographic key pairs [...] synced between the user’s devices via a cloud service. [...] stores an encrypted copy [...] Passkeys can also by design be available only from a single device from which they cannot be copied. > "single-device passkeys” [...] a physical security key could contain multiple single-device passkeys. > [...] generally referred to as “synced passkeys”, and those that never leave a single device are referred to as “device-bound passkeys”. So, your keys will rely on: * The cloud, or * Some specific phone, or * Some specific USB key. > They can’t be guessed, leaked, or stolen So, they can be lost. Also, stolen.

_cenw 3y ago
Synced passkeys usually bound to biometrics or some other rate-limited authentication like a pin, and at least Apple syncs them on your keychain, so it never is unencrypted in the cloud. And the general idea about device-bound passkeys is to enroll them from all your devices (Google encourages you to do so on first sign in from a device), so one surviving device is enough to continue the chain of trust.
- card_zero 3y ago
  Can you still access somebody else's phone by showing it a photo of their face, or has that been fixed? Perhaps it has to be a video of their face now.
  - _cenw 3y ago
    Face ID never had this issue, it projects a dot matrix on your face and reads back the distortion. The really old Android face unlock did.
- HeatrayEnjoyer 3y ago
  Many people only have one or two devices. Even if someone owns many, they're only one abusive partner or house fire away from losing them all. Even if I were to instill robust self-custody practices in 90% of the populace (an impossibly high bar if mere password hygiene hasn't caught on in 30 years), the remainder is still millions of people who will be locked out their entire digital life permanently.
rcaught 3y ago
So... passwords? Your passwords will rely on: * The cloud, or * Some specific computer They can be guessed, leaked, or stolen

_cenw 3y ago

Synced passkeys usually bound to biometrics or some other rate-limited authentication like a pin, and at least Apple syncs them on your keychain, so it never is unencrypted in the cloud. And the general idea about device-bound passkeys is to enroll them from all your devices (Google encourages you to do so on first sign in from a device), so one surviving device is enough to continue the chain of trust.

card_zero 3y ago
Can you still access somebody else's phone by showing it a photo of their face, or has that been fixed? Perhaps it has to be a video of their face now.
- _cenw 3y ago
  Face ID never had this issue, it projects a dot matrix on your face and reads back the distortion. The really old Android face unlock did.
HeatrayEnjoyer 3y ago
Many people only have one or two devices. Even if someone owns many, they're only one abusive partner or house fire away from losing them all. Even if I were to instill robust self-custody practices in 90% of the populace (an impossibly high bar if mere password hygiene hasn't caught on in 30 years), the remainder is still millions of people who will be locked out their entire digital life permanently.

rcaught 3y ago

So... passwords? Your passwords will rely on: * The cloud, or * Some specific computer They can be guessed, leaked, or stolen