5 ms·
You can use yubikeys as passkeys, if you are afraid of a Google/Apple ban
by umvi 2y ago
You can use yubikeys as passkeys, if you are afraid of a Google/Apple ban
- sph 2y agoWhat if you lose your yubikey? "Go enroll a new one in your 500 accounts" is not a good enough answer. The thing about a regular password manager is that it does not get lost.
- mrtesthah 2y agoThe point isn’t that we should have to trust Apple/Google for our passkeys — it’s that we should have full control over the backing store used by our password manager(s).
- toomuchtodo 2y agoThe standard supports exports, it should arrive; the vast majority of users will never export them from Google or iCloud synced storage though. https://news.ycombinator.com/item?id=35855133 https://news.ycombinator.com/item?id=35855133 ("HN: Passkeys will be importable, exportable, cross-device, and across managers")
- sph 2y agoI am unfamiliar with passkeys. Can they be exported and imported, or WILL it be possible one day? Because that affects my choice to adopt them today.
- vbezhenar 2y agoNative implementations do not allow exporting and importing. Of course technically it’s possible but they gone great lengths hiding it from user “for security”, so probably they wouldn’t allow any export. If you run vault warden, it worked for me at passkeys.io and it’s just an SQL DB, so surely you could extract anything (although I didn’t see a specific UI for it).
- Timshel 2y agoI have not tested it but some users in the bitwarden forum has mentionned that it's included in the vault export (cf https://community.bitwarden.com/t/passkey-portability/59177/16 https://community.bitwarden.com/t/passkey-portability/59177/...).
- toomuchtodo 2y agoIndividual choices to not adopt due to this requirement is unlikely to impact mass market adoption. While I certainly hope the export capability is delivered as promised, it won’t hold most folks back from adopting this auth mechanism. https://www.engadget.com/google-says-its-secure-entry-passkeys-have-been-used-a-billion-times-120001230.html https://www.engadget.com/google-says-its-secure-entry-passke... (“Google says its secure entry passkeys have been used a billion times by 400 million Google accounts”)
- tjoff 2y agoSo the average user has only used passkeys 2.5 times? Yikes.
- 1oooqooq 2y agoand i bet it went like: 1. login on computer. click next mindlessly on setup flow. 2. use account 3. try to login on phone. click next mindlessly on setup flow again. 4. where's my data?! oh well, lost my old account. let's use the new one 5. eternal confusion while switching devices. never return to site again. = 2.5 times per user
- toomuchtodo 2y agoHow often do you login to your Google account once logged in? I don't remember the last time Google asked me to login, because the session persists.
- tjoff 2y agoI hope that you properly segment your browsing then, because surely you don't browse the web while logged in to google?
- toomuchtodo 2y agoMoving the goalposts to a data security and privacy concern from strong auth factors. I don’t care if Google has my browsing history. I do care if someone else can log into my account, or ease of managing my own credentials. Auth protects you from others, data security and privacy measures protect you from the counterparty.
- maeil 2y agoUntil it arrives it's nothing but an empty promise. The biggest players have a lot to gain from not allowing export, or doing what Apple does with "right to repair" and now the DSA in the EU; technically "supporting" repairability or interoperability while making it all but impossible in reality. It's no surprise that they're trying to gain as much adoption as possible without having it, and that export is the part of the spec that was apparently not deemed important enough to have ready before doing so. KeepassXC is the only one supporting it, and just look at how much backlash they got, with veiled threats of requiring attestation and banning its usage. No, there is zero reason to be optimistic towards this.
- arianvanp 2y agoI have been following the discussions closely in https://github.com/w3c/webauthn https://github.com/w3c/webauthn and I haven't seen anything about exportability there in the past year. The only reference I can find is that post on Hachyderm from a year ago. We're a year later and the needle didn't move on this. Which is a bit worrying
- growse 2y agoWhere does it say that you have to trust Google / Apple? Passkeys are webauthn credentials. Store them in whatever webauthn store you like. I use a combination of bitwarden and iCloud.
- vbezhenar 2y agoFor 500 accounts you would need 20 yubikeys. That’s quite a yubikeyring.
- vaylian 2y agoTrue. I personally prefer non-residential keys that don't take up any space on your yubikey. The keys are reconstructed on the fly based on a value that I receive from the server I am authenticating against. Passkeys are residential keys and they consume storage. The minor upside is that they free the user from remembering their username.
- growse 2y agoThe other upside is that you can store them in either HSMs or software-backed stores (password managers) or hybrids (like your phone). It's trade-offs all the way down!
- theshrike79 2y agoYou can get a second one as backup. They actually recommend to do this themselves and provide tools for cloning.
- jonasdegendt 2y agoCorrect me if I'm wrong but I don't think you're meant to clone them per se. You're better off creating a unique passkey for each device, and if one is lost you can revoke that passkey without bricking your backup device as a login method at the same time. That's how I treat my Yubikeys at least. The only downside with this is that some services (e.g. PayPal) only let you create one passkey.
- lo0dot0 2y ago"The only downside" is a show stopper that means you do not have a Backup at all.
- umvi 2y agoMost services let you fall back on traditional username and password if you lose your passkey
- CatWChainsaw 2y agoThen why have one?
- paranoidrobot 2y agoPassword managers like 1Password support PassKeys.