3 ms·
Big problem with this is that enrolling the secondary passkey requires the authenticator to be present. This is super inconvenient and risky as it always requir
by Nextgrid 3y ago
Big problem with this is that enrolling the secondary passkey requires the authenticator to be present. This is super inconvenient and risky as it always requires both authenticators to be present at the same machine/physical location, exposing both to local, physical threats (faulty USB ports on your machine frying anything you plug in? Congrats, you've now fried your main and any backup authenticators before you realized what was happening).
Ideally, you should be able to get an authenticator's public key and be able to enroll one without presenting the authenticator itself, allowing you to keep it in a safe/etc.
This would enable an easy workflow - enroll main authenticator as normal, then enroll your safely-stored backup by pasting its public key. If you lose your main, go to your safe, get your backup and "promote" it to primary and enroll a new backup one which goes in the safe.
- 4ad 3y agoThis is why you need to enrol the secondary passkey at the same time you enrol the first one, not later when you might not have the authenticator present. In reality websites should not allow setting up a single passkey.
- cuu508 3y agoEnrolling both at the same time still requires both authenticators to be present at the same machine/physical location.
- e12e 3y agoProblem remains when you lose one, and need to block and enroll a new backup?
- radicality 3y agoApple actually forces you to use 2 keys when setting up security keys for iCloud, just did the setup few weeks ago.
- PaulHoule 3y agoIt always struck me that 2FA is a corporate suicide pact. Some percentage of users are going to lose their keys per year so your user base is going to decay like a radioactive element.
- jorvi 3y agoThat’s why most 2FA’s are 1.5FA by default where you can recover via SMS, delayed e-mail, etc, and you can (sometimes) only disable this by clicking through three scary screens and saving your 10 backup codes.