6 ms·
> I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only
by izacus 2y ago
> I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone.
There seems to be a lot of misunderstanding of passkeys indeed. They're in no way different than that random password stored in your password manager and can be (with this standard you're commenting on) moved around wherever you want them.
All passkey sites also support fallbacks to just password or other auth mode.
- troupo 2y ago> They're in no way different than that random password stored in your password manager Except in all the ways that matter: they are not accessible to users, they are tied to third-party vendors.
- mzhaase 2y agoThey are different from passwords in that they are never send over the web. They are a private key used to sign a challenge from the site.
- dustyventure 2y agoThe private keys are not sent to the relying party yet TFA is about a spec to send them over the web.
- NikolaNovak 2y ago>> All passkey sites also support fallbacks to just password or other auth mode. Is this a guaranteed thing? Are we saying any account I create cannot be Created with just a pass key; and that no site or service is able to discontinue the password option?
- barkerja 2y agoNo, this is not guaranteed.
- 9dev 2y agoIt is by necessity; at the very minimum, you’ll need an OTP via email, since you need an out-of-band method of identifying the user during the registration. I actually built a small web application that’s entirely passwordless, and it works really smoothly. I don’t get the antipathy towards Passkeys.
- NikolaNovak 2y agoMy antipathy stems from my lack of understanding, I freely admit, but it's a lack of understanding that's despite some modicum of intelligence. I feel I can take a password and print it on paper, memorize it, save it on a USB stick, tell it to my wife. I feel in control with passwords. Nobody owns them but me. Passkeys feel like a wild wild WILD west of providers and islands and standards. It feels like if I sign up to a website on my iPhone creating a pass key, it is a nontrivial amount of work and even less trivial amount of knowledge to transfer it to my android tablet or windows pc. Or maybe that's not even a thing and really I need to resign up on those devices? Or i need to authenticate a second device with my first one? So if I sign up to website 1 with my phone and website 2 with my tablet and website 3 with my laptop,if I want to access all of those from all my devices, I now have a fun weekend of syncing or something? And I have no idea how to help my mother inlaw with it unless it's some "create Icloud and trust apple and pray " system. More than anything, you prove my and disprove gp's point that passwords are not necessarily always going to be an option for all sites and services. In fact it feels everybody is yelling in my face that passwords are gone and this half baked complex system will be the only thing.
- lxgr 2y agoWith a draft standard that we have no way of knowing Google and Apple will implement?