3 ms·

> It depends on how a web site implements it, but keep in mind that everything that makes it easier to recover from a lost key also makes your account more vuln

> It depends on how a web site implements it, but keep in mind that everything that makes it easier to recover from a lost key also makes your account more vulnerable to attack. So having backups of your passkey keys is a really good idea. But those backups don't have to be in the cloud. You could keep local copies on your own devices, or even print the key on a sheet of paper and keep that in a safe. Obviously this isn't bad advice, but it is the reason I won't be diving into passkeys any time soon. Firefox Sync (the original version) had this philosophy: it's perfectly secure but if you lose your key, you've lost your bookmarks, history, and anything else that gets synced. For non-power users this is a catastrophic failure mode. For power users this still happens and it sucks. I was at Mozilla during this time and the failure modes of Sync were impressively common, even among employees. Nobody expects to lose their backup. If you were a victim of hurricane Helene, it's entirely likely your safe is gone and all of your devices are destroyed. If that also means you've permanently lost access to your files or email or whatever, that's really really bad. And completely within the realm of possibility! Obviously you can't fix this with cryptography alone. But it shows that passkeys can't be implemented as a full solution.

lisper 2y ago
But that's not a problem with passkeys, that's a problem with Firefox Sync.
- bastawhiz 2y ago
  It's a problem for anything where you need to manually keep backups of key material. It's why so many cryptobros lost millions (billions?). If you expect the average person to keep their passkey backup stored well enough to avoid the possibility of physical disaster or losing access to their Google Drive, you've set them up for failure. And when the stakes are losing access to your online life, that's a catastrophic design flaw.
  - lisper 2y ago
    > It's a problem for anything where you need to manually keep backups of key material. Well, OK, but what is the alternative? (Actually, you don't need to manually keep backups. You can have automatic backups, but those come with their own set of risks.)
    - bastawhiz 2y ago
      I'd give a key to my bank that they could create signatures with if I asked for (and was authenticated with) that third parties could trust to bypass my passkey. I'd pay a fee for it, the bank holds liability for verifying my identity. Banks aren't perfect but mine already has all my money and the deed to my house. I trust the safety of my bank more than I trust Google not to lock me out or all my hardware to be destroyed.
      - lisper 2y ago
        OK, so your proposed alternative is to give a key to a trusted third party (TTP). But how do you authenticate to that TTP?

lisper 2y ago

But that's not a problem with passkeys, that's a problem with Firefox Sync.

bastawhiz 2y ago
It's a problem for anything where you need to manually keep backups of key material. It's why so many cryptobros lost millions (billions?). If you expect the average person to keep their passkey backup stored well enough to avoid the possibility of physical disaster or losing access to their Google Drive, you've set them up for failure. And when the stakes are losing access to your online life, that's a catastrophic design flaw.
- lisper 2y ago
  > It's a problem for anything where you need to manually keep backups of key material. Well, OK, but what is the alternative? (Actually, you don't need to manually keep backups. You can have automatic backups, but those come with their own set of risks.)
  - bastawhiz 2y ago
    I'd give a key to my bank that they could create signatures with if I asked for (and was authenticated with) that third parties could trust to bypass my passkey. I'd pay a fee for it, the bank holds liability for verifying my identity. Banks aren't perfect but mine already has all my money and the deed to my house. I trust the safety of my bank more than I trust Google not to lock me out or all my hardware to be destroyed.
    - lisper 2y ago
      OK, so your proposed alternative is to give a key to a trusted third party (TTP). But how do you authenticate to that TTP?