5 ms·

I dont get it. How is changing What you know then what you have then what you are To passkeys any better ? Sure you cant hack them but what happens with losin

I dont get it. How is changing What you know then what you have then what you are To passkeys any better ? Sure you cant hack them but what happens with losing your phone ?

arielcostas 2y ago
They are supposed to be synced, for example by Google's Password Manager, iCloud, or whatever tool you use (bitwarden, 1Password...)
- perryizgr8 2y ago
  Can they be synced to my paper notebook in my desk drawer?
  - lioeters 2y ago
    Can they be synced to my own server, or my local machine like laptop or PC?
    - vbezhenar 2y ago
      You can self host bitwarden.
  - vbezhenar 2y ago
    Technically you can, but most software will make it impossible or hard. It is not supposed to leave the secure storage.
    - hulitu 2y ago
      > It is not supposed to leave the secure storage. How do they authenticate if they are not leaving the secure storage ? Through telepatic transmission ?
      - jsnell 2y ago
        Obviously via public key cryptography. It seems that you lack a sufficient understanding on this subject to back up the repeated snarky comments.
        r2_pilot 2y ago
        Then how are untrained users supposed to trust passkeys if they can't understand how they're secured when a third party is holding them?
        vel0city 2y ago
        How are untrained users supposed to trust passwords if they don't understand the differences between unsalted SHA1 versus PBKDF2 versus bcrypt and probably don't know what practices their third party is doing to properly hash the password?
        skydhash 2y ago
        Explaining password managers like the browsers' or 1password is easier than explaining passkeys. At least with password managers, you can export the whole database when switching platforms.
        endigma 2y ago
        This thread is crazy, it reads like 2 people arguing but there are actually zero repeat commenters, like some sort of debate conga line
        TheNewsIsHere 2y ago
        I agree. People ask the same questions about password managers just storing passwords. One of major failures of the passkey marketing is that the FIDO Alliance left it at: 1) Vendors marketing passkeys as this brand new thing for their customers; 2) Anyone technical needing to already know that passkeys weren’t this brand new vendor specific thing, and reading the standards documents. Passkeys are essentially just a marketing name for FIDO2 credentials with a focus on particular kinds of implementation. But FIDO didn’t bother to handle communications to technical folks outside the authentication space, and they’ve failed to do so effectively beyond that area.
    - rcxdude 2y ago
      > It is not supposed to leave the secure storage. "Secure storage" defined as the vendor's cloud services but not the user's eyeballs.

I dont get it. How is changing What you know then what you have then what you are To passkeys any better ? Sure you cant hack them but what happens with losing your phone ?

arielcostas 2y ago

They are supposed to be synced, for example by Google's Password Manager, iCloud, or whatever tool you use (bitwarden, 1Password...)

perryizgr8 2y ago
Can they be synced to my paper notebook in my desk drawer?
- lioeters 2y ago
  Can they be synced to my own server, or my local machine like laptop or PC?
  - vbezhenar 2y ago
    You can self host bitwarden.
- vbezhenar 2y ago
  Technically you can, but most software will make it impossible or hard. It is not supposed to leave the secure storage.
  - hulitu 2y ago
    > It is not supposed to leave the secure storage. How do they authenticate if they are not leaving the secure storage ? Through telepatic transmission ?
    - jsnell 2y ago
      Obviously via public key cryptography. It seems that you lack a sufficient understanding on this subject to back up the repeated snarky comments.
      - r2_pilot 2y ago
        Then how are untrained users supposed to trust passkeys if they can't understand how they're secured when a third party is holding them?
        vel0city 2y ago
        How are untrained users supposed to trust passwords if they don't understand the differences between unsalted SHA1 versus PBKDF2 versus bcrypt and probably don't know what practices their third party is doing to properly hash the password?
        skydhash 2y ago
        Explaining password managers like the browsers' or 1password is easier than explaining passkeys. At least with password managers, you can export the whole database when switching platforms.
        endigma 2y ago
        This thread is crazy, it reads like 2 people arguing but there are actually zero repeat commenters, like some sort of debate conga line
        TheNewsIsHere 2y ago
        I agree. People ask the same questions about password managers just storing passwords. One of major failures of the passkey marketing is that the FIDO Alliance left it at: 1) Vendors marketing passkeys as this brand new thing for their customers; 2) Anyone technical needing to already know that passkeys weren’t this brand new vendor specific thing, and reading the standards documents. Passkeys are essentially just a marketing name for FIDO2 credentials with a focus on particular kinds of implementation. But FIDO didn’t bother to handle communications to technical folks outside the authentication space, and they’ve failed to do so effectively beyond that area.
  - rcxdude 2y ago
    > It is not supposed to leave the secure storage. "Secure storage" defined as the vendor's cloud services but not the user's eyeballs.