5 ms·
If the passkey is all you have, then you're doomed (at least to the extent of whatever alternative recovery procedures the vendor is making available to you).
by rootusrootus 2y ago
If the passkey is all you have, then you're doomed (at least to the extent of whatever alternative recovery procedures the vendor is making available to you). That's why it's pretty universal to provide backup codes to put in your safe when setting up a passkey.
- create-username 2y agoyou should have passkeys on at least two or three devices
- EvanAnderson 2y agoHaving one more thing to remember to do when I create a new account seems like the kind of tedious make-work computers should be automating.
- rootusrootus 2y agoI agree. The better answer from my view is to handle passkeys like passwords and manage them the same way.
- hedora 2y agoHow do you keep those devices synced? I have over 500 accounts in my password manager. Do I need to manually set up 500 * 3 devices?
- klausa 2y agoYou use your password manager to sync them.
- create-username 2y agoI sync them manually, like a medieval peasant
- lxgr 2y agoUnfortunately that pattern negates many benefits of WebAuthN: That recovery code is phishable, can be captured by malware on the client or server etc.
- jesseendahl 2y agoAccount recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: set a new one via email recovery.
- CatWChainsaw 2y agoA backup code is a password made of numbers.