2 ms·

All the big implementations are locked into some big player. Like MS, Apple, Google. And the real independent implementations like bitwarden are often blocked

All the big implementations are locked into some big player. Like MS, Apple, Google. And the real independent implementations like bitwarden are often blocked by sites like PayPal does.

vel0city 2y ago
> All the big implementations are locked into some big player Often repeated. Doesn't make it true. As mentioned, I've got passkeys for services registered on multiple brands of physical authenticators and several platforms.
- wkat4242 2y ago
  Which ones then? Using yubikey means enrolling multiple of them as backup which a lot of sites don't allow. Other implementations are often blocked, eg on paypal I've never been able to do it and they also only allow one. The big tech ones don't have these issues but I won't use them because I want to keep control.
  - vel0city 2y ago
    > a lot of sites don't allow. About the only site I've come across that still only limits a single authenticator is the only one you've already mentioned. If I pointed out a site that only allowed five character upper case passwords with no lockout policy and really fast responses is that also proof passwords are completely untenable? Or just one actor with poor policy decisions And in the end one can just choose to not use passkeys with sites like PayPal. But the extreme majority I've used allowed multiple, as that's what the specifications recommended. In the end you can use passkeys without involving Google or Microsoft or Apple at all. Any argument that passkeys lock you into their platforms isn't based in reality and are repeating untruths. You don't need to use them to use passkeys.
    - tmerc 2y ago
      Just gonna point out that AWS IAM only started allowing multiple 2fa devices 2 years ago. https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul... It's entirely possible that many sites shared this flaw.
      - vel0city 2y ago
        Correct, AWS was one of a small handful of services I was thinking about which did have this restriction but now haven't had that restriction for multiple years.
    - wkat4242 2y ago
      Well for me it's 50% as the only two sites that I use and do passkeys are Microsoft and PayPal. Adoption is really slow. But yeah ok, if multiple are allowed then yes it's no longer a problem. I'm sure I read of more sites that had this problem but it is indeed possible they're fixed now.

All the big implementations are locked into some big player. Like MS, Apple, Google. And the real independent implementations like bitwarden are often blocked by sites like PayPal does.

vel0city 2y ago

> All the big implementations are locked into some big player Often repeated. Doesn't make it true. As mentioned, I've got passkeys for services registered on multiple brands of physical authenticators and several platforms.

wkat4242 2y ago
Which ones then? Using yubikey means enrolling multiple of them as backup which a lot of sites don't allow. Other implementations are often blocked, eg on paypal I've never been able to do it and they also only allow one. The big tech ones don't have these issues but I won't use them because I want to keep control.
- vel0city 2y ago
  > a lot of sites don't allow. About the only site I've come across that still only limits a single authenticator is the only one you've already mentioned. If I pointed out a site that only allowed five character upper case passwords with no lockout policy and really fast responses is that also proof passwords are completely untenable? Or just one actor with poor policy decisions And in the end one can just choose to not use passkeys with sites like PayPal. But the extreme majority I've used allowed multiple, as that's what the specifications recommended. In the end you can use passkeys without involving Google or Microsoft or Apple at all. Any argument that passkeys lock you into their platforms isn't based in reality and are repeating untruths. You don't need to use them to use passkeys.
  - tmerc 2y ago
    Just gonna point out that AWS IAM only started allowing multiple 2fa devices 2 years ago. https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ https://aws.amazon.com/blogs/security/you-can-now-assign-mul... It's entirely possible that many sites shared this flaw.
    - vel0city 2y ago
      Correct, AWS was one of a small handful of services I was thinking about which did have this restriction but now haven't had that restriction for multiple years.
  - wkat4242 2y ago
    Well for me it's 50% as the only two sites that I use and do passkeys are Microsoft and PayPal. Adoption is really slow. But yeah ok, if multiple are allowed then yes it's no longer a problem. I'm sure I read of more sites that had this problem but it is indeed possible they're fixed now.