3 ms·
> Sites still ultimately have to have a recovery process when someone does lose access. Do they? Is that legally mandated somewhere, or can they just say "You'
by ForHackernews 2y ago
> Sites still ultimately have to have a recovery process when someone does lose access.
Do they? Is that legally mandated somewhere, or can they just say "You're stuffed, make a new account if you want"?
- jesseendahl 2y agoAccount recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
- jakub_g 2y agoThis exactly where my distinction about "what the passkey actually is" is important: if it's only a password, then I assume I can do the recovery. Whereas if it's 2FA, I assume I can't.