3 ms·

I'm not at all sold on this experience for disaster-recovery reasons. I can put a backup Yubikey in a safe deposit box or other off-site location pretty easily

I'm not at all sold on this experience for disaster-recovery reasons. I can put a backup Yubikey in a safe deposit box or other off-site location pretty easily and for relatively cheaply. I'm not gonna buy and put a backup laptop or iPhone in one. If I lost all my devices in a natural disaster I want way to be able to get back in to accounts. And personally I don't want that to be cloud-dependent (bit of chicken-and-egg dependency story, it seems, plus a centralized weakness). I might be misunderstanding the device-as-passkey story, but the stuff I've read about it hasn't seemed to proactively answer that question.

skibbityboop 2y ago
Yeah, if your device is lost or destroyed and you rely on passkeys, you are well and truly f**ed. Your only hope is if you have recovery passwords stored in a password safe or manager. If you already have that safe or manager, than you can already very easily have 25+ character passphrases for every site you use, so what have passkeys gained you except having to be double-vigilant about having a recovery method for every login you create?
- mingus88 2y ago
  That’s not true. You can use iCloud keychain and have numerous recovery options, including other passkeys. A lost device is not a critical issue at all. To your questions, the password safe can store passkeys as well. The entire point is to get to a place where we aren’t all dependent on some remote site’s security to keep our secrets safe. Why use a 25+ character password which can be compromised in a number of ways when a passkey doesn’t involve sending secrets at all?
notatoad 2y ago
a good passkey implementation allows multiple passkeys. you can have faceid on your mac, and you can also have a yubikey in a safe somewhere for disaster recovery. also, passkeys get backed up in iCloud, so losing your device isn't really an issue. the disaster scenario is more what happens if apple locks you out of iCloud.
- mingus88 2y ago
  The main point of this article is that good implementations are few and far between Most of my banks don’t support it at all, but the few that do still require SMS as a recovery mechanism. So it’s pretty pointless from a security standpoint. Even O365 will keep pestering you to add a phone number for recovery if you go passwordless and remove your phone number. I think they may even force you to add it back in certain flows. I think Apple has one the better impls and they went hard on account security after the rash of celebrity nudes were traced back to poor iCloud account hygiene. Recovery codes get sent to every device in the account with an option to decline, passkeys are first class citizens, and they don’t need to know my phone number for any of it
- Tractor8626 2y ago
  So whenever I create another account - I need to fetch all my yubikeys from remote locations to enroll them? I mean if you have one or two accounts it's probably ok. My password manager contains hundreds of passwords. If I am to enroll hardware keys for each of them... Just no. You need to be able to clone/copy/backup your keys. Enrolling multiple keys - is non solution.
scarfaceneo 2y ago
Hi, to answer your hypothetical situation, what I do is save my passwords on apple passwords, and use two yubikeys as the security keys for the apple account itself (cool fact, apple forces you to use two keys as a safeguard, which I think is pretty cool and haven’t seen anyone else doing).
mooreds 2y ago
Disclosure: I work for FusionAuth. When we implemented passkeys a few years ago[0], we chose to implement them as a purely secondary authentication method. So you had to have an account, then you added a passkey. So you have the normal account recovery process if you need it, while you get the advantage of passkeys for improved, faster regular login. That's obviously a tradeoff. I wrote up a bit about this issue[1] last year but I think there's been some progress on standardizing backups of software passkey private keys[2]. The idea of syncing around a private key, no matter how protected it is, still makes me a bit queasy (as it seems you are) but I understand the motivation. 0: https://fusionauth.io/docs/lifecycle/authenticate-users/passwordless/webauthn-passkeys https://fusionauth.io/docs/lifecycle/authenticate-users/pass... 1: https://ciamweekly.substack.com/p/on-webauthn-and-passkeys https://ciamweekly.substack.com/p/on-webauthn-and-passkeys 2: https://www.w3.org/TR/webauthn-3/#sctn-credential-backup https://www.w3.org/TR/webauthn-3/#sctn-credential-backup

skibbityboop 2y ago

Yeah, if your device is lost or destroyed and you rely on passkeys, you are well and truly f**ed. Your only hope is if you have recovery passwords stored in a password safe or manager. If you already have that safe or manager, than you can already very easily have 25+ character passphrases for every site you use, so what have passkeys gained you except having to be double-vigilant about having a recovery method for every login you create?

mingus88 2y ago
That’s not true. You can use iCloud keychain and have numerous recovery options, including other passkeys. A lost device is not a critical issue at all. To your questions, the password safe can store passkeys as well. The entire point is to get to a place where we aren’t all dependent on some remote site’s security to keep our secrets safe. Why use a 25+ character password which can be compromised in a number of ways when a passkey doesn’t involve sending secrets at all?

notatoad 2y ago

a good passkey implementation allows multiple passkeys. you can have faceid on your mac, and you can also have a yubikey in a safe somewhere for disaster recovery. also, passkeys get backed up in iCloud, so losing your device isn't really an issue. the disaster scenario is more what happens if apple locks you out of iCloud.

mingus88 2y ago
The main point of this article is that good implementations are few and far between Most of my banks don’t support it at all, but the few that do still require SMS as a recovery mechanism. So it’s pretty pointless from a security standpoint. Even O365 will keep pestering you to add a phone number for recovery if you go passwordless and remove your phone number. I think they may even force you to add it back in certain flows. I think Apple has one the better impls and they went hard on account security after the rash of celebrity nudes were traced back to poor iCloud account hygiene. Recovery codes get sent to every device in the account with an option to decline, passkeys are first class citizens, and they don’t need to know my phone number for any of it
Tractor8626 2y ago
So whenever I create another account - I need to fetch all my yubikeys from remote locations to enroll them? I mean if you have one or two accounts it's probably ok. My password manager contains hundreds of passwords. If I am to enroll hardware keys for each of them... Just no. You need to be able to clone/copy/backup your keys. Enrolling multiple keys - is non solution.

scarfaceneo 2y ago

Hi, to answer your hypothetical situation, what I do is save my passwords on apple passwords, and use two yubikeys as the security keys for the apple account itself (cool fact, apple forces you to use two keys as a safeguard, which I think is pretty cool and haven’t seen anyone else doing).

mooreds 2y ago

Disclosure: I work for FusionAuth. When we implemented passkeys a few years ago[0], we chose to implement them as a purely secondary authentication method. So you had to have an account, then you added a passkey. So you have the normal account recovery process if you need it, while you get the advantage of passkeys for improved, faster regular login. That's obviously a tradeoff. I wrote up a bit about this issue[1] last year but I think there's been some progress on standardizing backups of software passkey private keys[2]. The idea of syncing around a private key, no matter how protected it is, still makes me a bit queasy (as it seems you are) but I understand the motivation. 0: https://fusionauth.io/docs/lifecycle/authenticate-users/passwordless/webauthn-passkeys https://fusionauth.io/docs/lifecycle/authenticate-users/pass... 1: https://ciamweekly.substack.com/p/on-webauthn-and-passkeys https://ciamweekly.substack.com/p/on-webauthn-and-passkeys 2: https://www.w3.org/TR/webauthn-3/#sctn-credential-backup https://www.w3.org/TR/webauthn-3/#sctn-credential-backup