3 ms·

a good passkey implementation allows multiple passkeys. you can have faceid on your mac, and you can also have a yubikey in a safe somewhere for disaster recov

• mingus88 2y ago
  The main point of this article is that good implementations are few and far between Most of my banks don’t support it at all, but the few that do still require SMS as a recovery mechanism. So it’s pretty pointless from a security standpoint. Even O365 will keep pestering you to add a phone number for recovery if you go passwordless and remove your phone number. I think they may even force you to add it back in certain flows. I think Apple has one the better impls and they went hard on account security after the rash of celebrity nudes were traced back to poor iCloud account hygiene. Recovery codes get sent to every device in the account with an option to decline, passkeys are first class citizens, and they don’t need to know my phone number for any of it
• Tractor8626 2y ago
  So whenever I create another account - I need to fetch all my yubikeys from remote locations to enroll them? I mean if you have one or two accounts it's probably ok. My password manager contains hundreds of passwords. If I am to enroll hardware keys for each of them... Just no. You need to be able to clone/copy/backup your keys. Enrolling multiple keys - is non solution.