5 ms·

I’m all for alternatives to passwords but what is the pathway for “I lost passkey” Is it sending a reset to a recovery email?

by atonse 2y ago

zsjkadj 2y ago
multiple passkeys
vbezhenar 2y ago
It is outside of passkey scope. Most services will use email to recover access.
- nottorp 2y ago
  > It is outside of passkey scope. Yeah right, pass along responsability to someone else. And you wonder why people don't trust this "security" solution.
  - vbezhenar 2y ago
    There's no reason not to trust it. It's strictly better than passwords in almost every regard. Of course if you manage your passwords well, you don't get more security with passkeys, because your account is already safe enough. But for someone, who used to write his universal "Johny1987" password on a sticker at his display, passkey provides security and usability benefits. Passkey is just not supposed to solve all the problems in the world. It's supposed to replace login and password and that's about it. Authentication.
    - nottorp 2y ago
      That would be fine if it didn't introduce device dependency and vendor lock in. How do I get my keys out of Apple's wallet again? Or out of a Yubikey for that matter. They are no longer under my control and I depend on Apple's or Yubikey's benevolence to access my services.
      - bigfatkitten 2y ago
        > Or out of a Yubikey for that matter. You don't, and neither does an adversary. That is literally the whole point of paying $50 for a Yubikey.
        nottorp 2y ago
        So I need to pay for the privilege of having a single point of failure for my credentials :) Oh no I forgot, I could pay even more to have backups.
        bigfatkitten 2y ago
        It's an open specification. You can make your own if you like. If the security properties of a hardware authenticator aren't important to you, you don't need to use one at all.
        nottorp 2y ago
        A phone is also a hardware authenticator in this case. With the same problems in case of theft/destruction.
Scion9066 2y ago
Basically the same as if you had lost a physical key: You either have an extra set up or you work around the problem through some kind of recovery method.
- deleted 2y ago
  [deleted]
- Kwpolska 2y ago
  A trusted third party has a copy of the physical key to my flat. I handed them over once and they still work. I can print out the passwords and 2FA keys required to recover the most basic services (such as primary email and password manager) — as long as I don't change the credentials, it will keep working. But if I use passkeys stored on device, what are my recovery options? Do I need to retrieve the backup device every time I create a new passkey?

I’m all for alternatives to passwords but what is the pathway for “I lost passkey” Is it sending a reset to a recovery email?

by atonse 2y ago

I’m all for alternatives to passwords but what is the pathway for “I lost passkey” Is it sending a reset to a recovery email?

zsjkadj 2y ago

multiple passkeys

vbezhenar 2y ago

It is outside of passkey scope. Most services will use email to recover access.

nottorp 2y ago
> It is outside of passkey scope. Yeah right, pass along responsability to someone else. And you wonder why people don't trust this "security" solution.
- vbezhenar 2y ago
  There's no reason not to trust it. It's strictly better than passwords in almost every regard. Of course if you manage your passwords well, you don't get more security with passkeys, because your account is already safe enough. But for someone, who used to write his universal "Johny1987" password on a sticker at his display, passkey provides security and usability benefits. Passkey is just not supposed to solve all the problems in the world. It's supposed to replace login and password and that's about it. Authentication.
  - nottorp 2y ago
    That would be fine if it didn't introduce device dependency and vendor lock in. How do I get my keys out of Apple's wallet again? Or out of a Yubikey for that matter. They are no longer under my control and I depend on Apple's or Yubikey's benevolence to access my services.
    - bigfatkitten 2y ago
      > Or out of a Yubikey for that matter. You don't, and neither does an adversary. That is literally the whole point of paying $50 for a Yubikey.
      - nottorp 2y ago
        So I need to pay for the privilege of having a single point of failure for my credentials :) Oh no I forgot, I could pay even more to have backups.
        bigfatkitten 2y ago
        It's an open specification. You can make your own if you like. If the security properties of a hardware authenticator aren't important to you, you don't need to use one at all.
        nottorp 2y ago
        A phone is also a hardware authenticator in this case. With the same problems in case of theft/destruction.

Scion9066 2y ago

Basically the same as if you had lost a physical key: You either have an extra set up or you work around the problem through some kind of recovery method.

deleted 2y ago
[deleted]
Kwpolska 2y ago
A trusted third party has a copy of the physical key to my flat. I handed them over once and they still work. I can print out the passwords and 2FA keys required to recover the most basic services (such as primary email and password manager) — as long as I don't change the credentials, it will keep working. But if I use passkeys stored on device, what are my recovery options? Do I need to retrieve the backup device every time I create a new passkey?