39 ms·

But that's not a problem with passkeys, that's a problem with Firefox Sync.

• bastawhiz 2y ago
  It's a problem for anything where you need to manually keep backups of key material. It's why so many cryptobros lost millions (billions?). If you expect the average person to keep their passkey backup stored well enough to avoid the possibility of physical disaster or losing access to their Google Drive, you've set them up for failure. And when the stakes are losing access to your online life, that's a catastrophic design flaw.
  • lisper 2y ago
    > It's a problem for anything where you need to manually keep backups of key material. Well, OK, but what is the alternative? (Actually, you don't need to manually keep backups. You can have automatic backups, but those come with their own set of risks.)
    • bastawhiz 2y ago
      I'd give a key to my bank that they could create signatures with if I asked for (and was authenticated with) that third parties could trust to bypass my passkey. I'd pay a fee for it, the bank holds liability for verifying my identity. Banks aren't perfect but mine already has all my money and the deed to my house. I trust the safety of my bank more than I trust Google not to lock me out or all my hardware to be destroyed.
      • lisper 2y ago
        OK, so your proposed alternative is to give a key to a trusted third party (TTP). But how do you authenticate to that TTP?