3 ms·

... away from carriers and into the hands of Google/Apple/Microsoft, who can kill your account for any and no reason at all. Except for that one giant issue, p

... away from carriers and into the hands of Google/Apple/Microsoft, who can kill your account for any and no reason at all. Except for that one giant issue, passkeys are gonna be great.

patmorgan23 3y ago
There are several 'boutique' email providers (fast mail, proton, etc) that you can use instead of the big 3. You can even host your own MX server but use a relay service so you don't have to deal with IP reputation issues.
- Avicebron 3y ago
  lol relay services have reputation issues, I was talking to someone today about trying to whitelist some vendor this company uses because they use a relay service and it looks sketch as hell when emails show up seeming to pretend to be someone else
  - nijave 3y ago
    Sketchy relay services have issues. Haven't had issues with AWS SES or Sendgrid They should still have proper SPF/DKIM/DMARC so you can verify the sender even if it was relayed
CharlesW 3y ago
> Except for that one giant issue, passkeys are gonna be great. Unlike passwords, you can have multiple passkeys associated with an account. Accessing from an iPhone? Use your Apple passkey. From Android? Use your Google passkey. Want cross-platform? Use your 1Password passkey. Etc.
- jasonjayr 3y ago
  Right. Relaying Parties (RPs) need to have beaten into their implementations that multiple keys for each identity is normal + correct behavior, and the number of multiple keys should not be unreasonably limited.
  - ianburrell 3y ago
    After the trouble of adding multiple keys, I think there needs to be way to easily add multiple keys. Like uploaded file or service that has list of public keys. Something like cross-sign the keys and then authenticate one of them. I wonder if hassle means there will be more use of OAuth but that means trust.
    - lxgr 3y ago
      This is indeed the elephant in the room with WebAuthN. There needs to be a way to e.g. share the secret seed in one passkey securely with another and put that in a safe deposit box, with a friend etc. without needing access to both keys whenever a new account is added. It's a real shame that most stakeholders in FIDO/WebAuthN have moved on to passkeys as the canonical path forward over hardware-based solutions like this. Passkeys are definitely better than passwords, but they shouldn't be the only option out there as-is.
      - TheNewsIsHere 3y ago
        Yubico had done some work back in (I want to say..) 2020 to solve this very problem: bootstrapping a new key based on existing trust with an existing key. Of course the trick remains of needing to have access to both keys for at least a short time to create the relationship between them. They worked out some of the mathematics and cryptography they'd need, but it didn't seem to go anywhere. They wrote a blog post about it but I'm having trouble locating it.
        lxgr 3y ago
        I remember this as well, and it's a real shame it didn't go anywhere. In terms of user experience, they could sell pre-linked "Yubikey pairs" or offer a user experience of e.g. plugging both into the same computer and resetting them via a long press to "entangle" the pair cryptographically.
        TheNewsIsHere 3y ago
- tekknik 3y ago
  > Want cross-platform? Use your 1Password passkey. 1Password is dead to me the second I can use a passkey everywhere. I’m already removing them from my life. At any rate it’s not needed. If I have an apple passkey and am on PC (or a work mac) I can just scan with my iphone or ipad.
  - CharlesW 3y ago
    Can you share more about how [1Password syncs keys] is bad but [Apple syncs keys] is good? I use both and am sincerely interested.
    - tekknik 3y ago
      Because 1Password started charging a subscription for the exact same features they were charging a flat fee for. And when customers that had bought 1Passwords product year after year every year started to complain, they just ignore them. Then to attempt to force people to upgrade, they stated they would stop updating old versions of the app so at some point you’ll have to pay to continue accessing your passwords. Are you really unaware if the password vault highjacking 1Password is and has been trying to do for 5+ years now?
      - CharlesW 3y ago
        > Because 1Password started charging a subscription for the exact same features they were charging a flat fee for. Fair enough! I'm also subscription-avoidant generally, but 1Password's yearly $60 family plan works for me. Thanks!
        tekknik 3y ago
        Yea for sure, it works for some and not for others. I’m likely biased from the subscription fatigue so take what I say with ample salt. Sharing passwords between families is definitely a problem for me still, like sharing 401k accounts with my wife. Hopefully passkeys and the respective family accounts with the majors can solve this eventually.
Suppafly 3y ago
I have google fi and I'm always a little low key worried that they'll block my account which will kill my phone/docs/drive/email all at once. It also kinda sucks having google as your email and your phone when they want to use email to verify your account settings and you can't get into your account. This happened to my wife, and they essentially have no support on the fi side and the gmail side support isn't super helpful. She was eventually able to recover her gmail account and fix her fi activation but it a huge pain and took a couple of days.
- umbra07 3y ago
  definitely shift off google for your email. either shift off google for your documents, or at least have regular backups.
- ryandrake 3y ago
  I would not put all my eggs in one basket like that. You're one inadvertent terms-of-service violation from losing a huge chunk of your digital identity with no recourse.

... away from carriers and into the hands of Google/Apple/Microsoft, who can kill your account for any and no reason at all. Except for that one giant issue, passkeys are gonna be great.

patmorgan23 3y ago

There are several 'boutique' email providers (fast mail, proton, etc) that you can use instead of the big 3. You can even host your own MX server but use a relay service so you don't have to deal with IP reputation issues.

Avicebron 3y ago
lol relay services have reputation issues, I was talking to someone today about trying to whitelist some vendor this company uses because they use a relay service and it looks sketch as hell when emails show up seeming to pretend to be someone else
- nijave 3y ago
  Sketchy relay services have issues. Haven't had issues with AWS SES or Sendgrid They should still have proper SPF/DKIM/DMARC so you can verify the sender even if it was relayed

CharlesW 3y ago

> Except for that one giant issue, passkeys are gonna be great. Unlike passwords, you can have multiple passkeys associated with an account. Accessing from an iPhone? Use your Apple passkey. From Android? Use your Google passkey. Want cross-platform? Use your 1Password passkey. Etc.

jasonjayr 3y ago
Right. Relaying Parties (RPs) need to have beaten into their implementations that multiple keys for each identity is normal + correct behavior, and the number of multiple keys should not be unreasonably limited.
- ianburrell 3y ago
  After the trouble of adding multiple keys, I think there needs to be way to easily add multiple keys. Like uploaded file or service that has list of public keys. Something like cross-sign the keys and then authenticate one of them. I wonder if hassle means there will be more use of OAuth but that means trust.
  - lxgr 3y ago
    This is indeed the elephant in the room with WebAuthN. There needs to be a way to e.g. share the secret seed in one passkey securely with another and put that in a safe deposit box, with a friend etc. without needing access to both keys whenever a new account is added. It's a real shame that most stakeholders in FIDO/WebAuthN have moved on to passkeys as the canonical path forward over hardware-based solutions like this. Passkeys are definitely better than passwords, but they shouldn't be the only option out there as-is.
    - TheNewsIsHere 3y ago
      Yubico had done some work back in (I want to say..) 2020 to solve this very problem: bootstrapping a new key based on existing trust with an existing key. Of course the trick remains of needing to have access to both keys for at least a short time to create the relationship between them. They worked out some of the mathematics and cryptography they'd need, but it didn't seem to go anywhere. They wrote a blog post about it but I'm having trouble locating it.
      - lxgr 3y ago
        I remember this as well, and it's a real shame it didn't go anywhere. In terms of user experience, they could sell pre-linked "Yubikey pairs" or offer a user experience of e.g. plugging both into the same computer and resetting them via a long press to "entangle" the pair cryptographically.
        TheNewsIsHere 3y ago
tekknik 3y ago
> Want cross-platform? Use your 1Password passkey. 1Password is dead to me the second I can use a passkey everywhere. I’m already removing them from my life. At any rate it’s not needed. If I have an apple passkey and am on PC (or a work mac) I can just scan with my iphone or ipad.
- CharlesW 3y ago
  Can you share more about how [1Password syncs keys] is bad but [Apple syncs keys] is good? I use both and am sincerely interested.
  - tekknik 3y ago
    Because 1Password started charging a subscription for the exact same features they were charging a flat fee for. And when customers that had bought 1Passwords product year after year every year started to complain, they just ignore them. Then to attempt to force people to upgrade, they stated they would stop updating old versions of the app so at some point you’ll have to pay to continue accessing your passwords. Are you really unaware if the password vault highjacking 1Password is and has been trying to do for 5+ years now?
    - CharlesW 3y ago
      > Because 1Password started charging a subscription for the exact same features they were charging a flat fee for. Fair enough! I'm also subscription-avoidant generally, but 1Password's yearly $60 family plan works for me. Thanks!
      - tekknik 3y ago
        Yea for sure, it works for some and not for others. I’m likely biased from the subscription fatigue so take what I say with ample salt. Sharing passwords between families is definitely a problem for me still, like sharing 401k accounts with my wife. Hopefully passkeys and the respective family accounts with the majors can solve this eventually.

Suppafly 3y ago

I have google fi and I'm always a little low key worried that they'll block my account which will kill my phone/docs/drive/email all at once. It also kinda sucks having google as your email and your phone when they want to use email to verify your account settings and you can't get into your account. This happened to my wife, and they essentially have no support on the fi side and the gmail side support isn't super helpful. She was eventually able to recover her gmail account and fix her fi activation but it a huge pain and took a couple of days.

umbra07 3y ago
definitely shift off google for your email. either shift off google for your documents, or at least have regular backups.
ryandrake 3y ago
I would not put all my eggs in one basket like that. You're one inadvertent terms-of-service violation from losing a huge chunk of your digital identity with no recourse.