5 ms·

Passkeys are terrifying, and I don’t understand why the companies pushing them are doing so. What are their motives? What do they gain from catastrophically inc

by reshlo 2y ago

Passkeys are terrifying, and I don’t understand why the companies pushing them are doing so. What are their motives? What do they gain from catastrophically increasing the risk that users completely lose access to our ability to conduct our lives? If someone steals my phone today, I can still access most of my accounts, and can regain access quickly to the others. Now let’s assume passkeys are ubiquitous and used to log in to every website. If they can’t be exported, then your entire digital existence is at the mercy of whatever device or technology platform you use to store your passkeys. If you lose access to the platform, you also permanently lose access to every single account you’ve ever signed up for. For me, that would include losing access to my retirement savings, tax records, and the ability to communicate with many of my friends, to give a few examples. My computer also doesn’t have Bluetooth, which means I can no longer log in to any websites on it even when I do have access to my passkeys.

Hypnosis6173 2y ago
I mean, isn't the idea from them that you have 2 or more of them? Shure not everybody does that and some sites don't really support that but thinking about this concept of having "physical key s" to your data makes a lot of sense to me. Don't know how this change will affect my trust in the concept
- reshlo 2y ago
  > I mean, isn't the idea from them that you have 2 or more of them? So now I need to buy an extra phone from a different manufacturer than the one I already own, or sign up for another paid service? I’m starting to see what their motive might be now. Is it even a requirement of the passkey standard to allow the user to create more than one passkey for your website?
  - fmajid 2y ago
    It isn’t but really should be. Apple requires you to register a minimum of two U2F keys if you use that as 2FA for iCloud.
- afiori 2y ago
  As any kind of key you need to be able to replace them after you lose them (think of a flood or a house fire) so either: 1. You accept a non-trivial risk to be locked out forever of what you used those keys for 2. You still have a password login to revoke/create keys 3. You invest in enough redundacy to never lose all of your keys IMHO only 2. is viable and then keys are just a different implementation of a password manager.
  - lxgr 2y ago
    My keychain has two physical keys, and these change only every time I move. Of passkeys, I have quite a bit more, with new ones added at least every few weeks. That makes them much harder to physically or even logically replicate one by one.
    - afiori 2y ago
      > My keychain has two physical keys, and these change only every time I move. How often they change is irrelevant, the point is how you would recover them. > Of passkeys, I have quite a bit more, with new ones added at least every few weeks. That makes them much harder to physically or even logically replicate one by one. But what is your plan if you lose them? either you plan to never lose them (3.), you have a way to replace them (2.) or you accept the risk to get locked out (1.)
      - jesseendahl 2y ago
        Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
        lxgr 2y ago
        > If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery. If that’s an option (and it often really is!), why go through all the trouble of implementing passkeys and not just implement “login via email”? For some services, that’s not secure enough though.
- rlpb 2y ago
  Most sites that support passkeys only allow one passkey per account, and it’s never clear whether they do or not.
- JohnFen 2y ago
  > isn't the idea from them that you have 2 or more of them? Properly managing multiple ubikeys and the like is a huge pain the butt.
ForHackernews 2y ago
> I don’t understand why the companies pushing them are doing so > your entire digital existence is at the mercy of whatever device or technology platform you use to store your passkeys.

by reshlo 2y ago

Hypnosis6173 2y ago

I mean, isn't the idea from them that you have 2 or more of them? Shure not everybody does that and some sites don't really support that but thinking about this concept of having "physical key s" to your data makes a lot of sense to me. Don't know how this change will affect my trust in the concept

reshlo 2y ago
> I mean, isn't the idea from them that you have 2 or more of them? So now I need to buy an extra phone from a different manufacturer than the one I already own, or sign up for another paid service? I’m starting to see what their motive might be now. Is it even a requirement of the passkey standard to allow the user to create more than one passkey for your website?
- fmajid 2y ago
  It isn’t but really should be. Apple requires you to register a minimum of two U2F keys if you use that as 2FA for iCloud.
afiori 2y ago
As any kind of key you need to be able to replace them after you lose them (think of a flood or a house fire) so either: 1. You accept a non-trivial risk to be locked out forever of what you used those keys for 2. You still have a password login to revoke/create keys 3. You invest in enough redundacy to never lose all of your keys IMHO only 2. is viable and then keys are just a different implementation of a password manager.
- lxgr 2y ago
  My keychain has two physical keys, and these change only every time I move. Of passkeys, I have quite a bit more, with new ones added at least every few weeks. That makes them much harder to physically or even logically replicate one by one.
  - afiori 2y ago
    > My keychain has two physical keys, and these change only every time I move. How often they change is irrelevant, the point is how you would recover them. > Of passkeys, I have quite a bit more, with new ones added at least every few weeks. That makes them much harder to physically or even logically replicate one by one. But what is your plan if you lose them? either you plan to never lose them (3.), you have a way to replace them (2.) or you accept the risk to get locked out (1.)
    - jesseendahl 2y ago
      Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
      - lxgr 2y ago
        > If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery. If that’s an option (and it often really is!), why go through all the trouble of implementing passkeys and not just implement “login via email”? For some services, that’s not secure enough though.
rlpb 2y ago
Most sites that support passkeys only allow one passkey per account, and it’s never clear whether they do or not.
JohnFen 2y ago
> isn't the idea from them that you have 2 or more of them? Properly managing multiple ubikeys and the like is a huge pain the butt.

ForHackernews 2y ago

> I don’t understand why the companies pushing them are doing so > your entire digital existence is at the mercy of whatever device or technology platform you use to store your passkeys.