3 ms·

So I should get locked out of all services when my device breaks?

• dwattttt 2y ago
  You should produce a key per device, and produce a backup key that is safely stored & not used anywhere. You can recover if you lose all devices via your break-glass backup key, and you limit the blast radius of "my key got stolen" from rotating all your keys to just a single device (or maybe the more likely "I screwed up and pushed my key somewhere public")
  • crote 2y ago
    ... which is completely nonviable if you connect to more than a single service. I agree that you should use a different key per device, but when you connect to over a dozen different services/machines it quickly starts to become a serious chore to add another key. Have fun spending an hour enrolling your new device - provided you can even remember every single usage it should be enrolled with.
    • 4ad 2y ago
      SSH certificates solve this issue. AFAIK there is no equivalent for Passkeys.
      • crote 2y ago
        Unfortunately SSH certificates have really poor uptake in practice, and it's essentially unheard of to have a personal CA instead of a per-company CA. But yes, having a single long-living "primary key" everyone can trust which you'd use to generate short-living per-device "secondary keys" would indeed be the ideal solution.