3 ms·

I use far more sites than I ssh into servers, which makes this much more of a pain. Like, every time I sign up to a site I need to grab all 5+ devices I might e

by Macha 3y ago

I use far more sites than I ssh into servers, which makes this much more of a pain. Like, every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? If all my devices are destroyed in a house fire again, I'm locked out of everything? These have been my big concerns.

vel0city 3y ago
> every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? You don't need to log in to every app on every device the instant you register a new account. Just make a passkey on a couple of devices that you're likely to have around and you'll probably have what you need when you need it. When I register on a new site that uses passkeys, I might create a key on whatever computer I'm on and a portable authenticator like my phone or my security token. So, say I'm at home on my deskop, and TotallyCoolService has the option for a passkey. I'll make one on my desktop, and then go ahead and make one on my security token. Later I'm out and I want to check in on TotallyCoolService on my phone. No worries, I just tap my security token to my phone and I'm logged in. Later I'm in the garage working on my motorcycle and want to reference something on TotallyCoolService on my laptop and my USB token is in my backpack inside. No problem, I can sign in with my phone. Now I've got security tokens on most of my common devices and its not like I had to spend time gathering all of them at account creation. I don't instantly run home to my desktop and log in the moment I sign up for a new site while out and about. But I do go and sign in eventually, even if only to ensure there's a backup key there.
- Macha 3y ago
  This really doesn't contradict the problem of needing to sort out M sites x N devices, where M can be very large. Whether you do it eventually or do it straight away. Unless you can predict which devices you will have and which sites you will need access to at any given point, then it degrades to needing everything authenticated just in case.
  - vel0city 3y ago
    I'm pretty much never too far from either my phone and my security key, seeing as how at least my phone is my car key and my wallet the majority of the time and a security key lives in my backpack. Sure, M devices can be quite large, but the odds of me being at only one device and not any of my portable devices is extremely small. As long as I have at least one other device I've previously logged in to somewhat handy, I can still easily get in. Maybe that initial login is marginally more complicated, but IMO the ease of future authentications more than makes up for the small bit of initial friction the first time. And in the rare instance where I'm suddenly on the moon and realize I left practically every other computing device and physical authenticator on another planet, I guess I just won't have access to a DnD tool. Oh well.
- abdullahkhalids 3y ago
  > No worries, I just tap my security token to my phone and I'm logged in. What allows you to tap your token on your phone and register a passkey-stored-on-phone registered with TotallyCoolService? Did you previously set your phone and token to be "mutually trusted devices" in some way? Or what's preventing a thief from tapping my token on their phone to register it on TotallyCoolService?
  - vel0city 3y ago
    It requires a PIN to give a resident key, and too many pin failures wipes it. Other authenticators have biometric requirements.
    - abdullahkhalids 3y ago
      I see. So the weakest link in the security chain is that someone discovers the <6 digit pin on your usb key (easy on a security camera), and then manages to steal it for 2 min. Not terrible for anyone whose threat model is not targeted attacks. But quite bad for people whose threat model is exactly that.

by Macha 3y ago

vel0city 3y ago

> every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? You don't need to log in to every app on every device the instant you register a new account. Just make a passkey on a couple of devices that you're likely to have around and you'll probably have what you need when you need it. When I register on a new site that uses passkeys, I might create a key on whatever computer I'm on and a portable authenticator like my phone or my security token. So, say I'm at home on my deskop, and TotallyCoolService has the option for a passkey. I'll make one on my desktop, and then go ahead and make one on my security token. Later I'm out and I want to check in on TotallyCoolService on my phone. No worries, I just tap my security token to my phone and I'm logged in. Later I'm in the garage working on my motorcycle and want to reference something on TotallyCoolService on my laptop and my USB token is in my backpack inside. No problem, I can sign in with my phone. Now I've got security tokens on most of my common devices and its not like I had to spend time gathering all of them at account creation. I don't instantly run home to my desktop and log in the moment I sign up for a new site while out and about. But I do go and sign in eventually, even if only to ensure there's a backup key there.

Macha 3y ago
This really doesn't contradict the problem of needing to sort out M sites x N devices, where M can be very large. Whether you do it eventually or do it straight away. Unless you can predict which devices you will have and which sites you will need access to at any given point, then it degrades to needing everything authenticated just in case.
- vel0city 3y ago
  I'm pretty much never too far from either my phone and my security key, seeing as how at least my phone is my car key and my wallet the majority of the time and a security key lives in my backpack. Sure, M devices can be quite large, but the odds of me being at only one device and not any of my portable devices is extremely small. As long as I have at least one other device I've previously logged in to somewhat handy, I can still easily get in. Maybe that initial login is marginally more complicated, but IMO the ease of future authentications more than makes up for the small bit of initial friction the first time. And in the rare instance where I'm suddenly on the moon and realize I left practically every other computing device and physical authenticator on another planet, I guess I just won't have access to a DnD tool. Oh well.
abdullahkhalids 3y ago
> No worries, I just tap my security token to my phone and I'm logged in. What allows you to tap your token on your phone and register a passkey-stored-on-phone registered with TotallyCoolService? Did you previously set your phone and token to be "mutually trusted devices" in some way? Or what's preventing a thief from tapping my token on their phone to register it on TotallyCoolService?
- vel0city 3y ago
  It requires a PIN to give a resident key, and too many pin failures wipes it. Other authenticators have biometric requirements.
  - abdullahkhalids 3y ago
    I see. So the weakest link in the security chain is that someone discovers the <6 digit pin on your usb key (easy on a security camera), and then manages to steal it for 2 min. Not terrible for anyone whose threat model is not targeted attacks. But quite bad for people whose threat model is exactly that.