4 ms·

When using a passkey as the only factor, it gets complicated, but I think that will be the future: Email and SMS as fallbacks with additional factors like risk-

When using a passkey as the only factor, it gets complicated, but I think that will be the future: Email and SMS as fallbacks with additional factors like risk-based location checks (or local storage hints) to have a viable recovery mechanism parallel to passkeys. I think Github has a nice approach that we use as a role model: Collect as many fallbacks as possible in a convenient manner. Adding passkeys on any new device and regularly reminding people to check their fallbacks. That's still way more secure than passwords only, where the fallback is practically always a form of email OTP. Also social logins from Google or Apple can act as a fallback as they are (mostly) 2FA.

bayindirh 2y ago
I'm not against using a passkey as a single factor, and having fallbacks. It's reasonable if you can reliably attach that key to a physical device, so the device can't be impersonated. I don't think that we should target MIL-xxx standards for daily use, but my security is comparably important to me as military's missile codes are important to them. So, I don't want my passkey-based services to have a security theater in the name of convenience. There should be some friction to force a baseline security.
- p0seidon 2y ago
  Agree, but I think in a B2C context, you need convenience first; then security can follow.
  - bayindirh 2y ago
    I think it depends. Banking, primary e-mails, etc. are extremely important systems today, and they should bias towards security. Other platforms where we talk can take a more balanced approach, and more casual sites can lean towards convenience, if you ask me.
    - joncrocks 2y ago
      Indeed, the problem with lots of fallbacks is that they can invalidate user's requests for higher security. Security can sometimes end up being only as strong as the weakest link. Make the fallback too lax and you might as well not bother with 2FA/Passkeys at all.

bayindirh 2y ago

I'm not against using a passkey as a single factor, and having fallbacks. It's reasonable if you can reliably attach that key to a physical device, so the device can't be impersonated. I don't think that we should target MIL-xxx standards for daily use, but my security is comparably important to me as military's missile codes are important to them. So, I don't want my passkey-based services to have a security theater in the name of convenience. There should be some friction to force a baseline security.

p0seidon 2y ago
Agree, but I think in a B2C context, you need convenience first; then security can follow.
- bayindirh 2y ago
  I think it depends. Banking, primary e-mails, etc. are extremely important systems today, and they should bias towards security. Other platforms where we talk can take a more balanced approach, and more casual sites can lean towards convenience, if you ask me.
  - joncrocks 2y ago
    Indeed, the problem with lots of fallbacks is that they can invalidate user's requests for higher security. Security can sometimes end up being only as strong as the weakest link. Make the fallback too lax and you might as well not bother with 2FA/Passkeys at all.