6 ms·
> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account And from this account you may be locked out for vario
by mihaaly 2y ago
> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account
And from this account you may be locked out for various reasons anytime, as it happened to countless persons previously, violating exotic or even understandable rules, or just been in the crossfire of some galactic corporate incompetence (some f'd up), but this way you'd be locking yourself out of everything especially if you were that user in the vacuum, exposing yourself to the mercy of a single organization with changing managemenet and incentives as the wind turns in a city's dense downtown.
- skybrian 2y agoI solve this by creating two passkeys for each account, for iOS and Chrome. This covers all the devices I might use to log in and there’s no single point of failure.
- HumanOstrich 2y agoThat doesn't solve anything. You just have twice as many problems now.
- skybrian 2y agoWhat are you talking about? Redundancy is how you avoid getting locked out. Each passkey serves as a backup for the other one. More generally, you should have two keys for any lock, so you can still get in if you lose one of them.
- michaelt 2y agoSetting up both Apple and Google passkeys solves: * Lost access to your Google account, but still have access to your Apple account (or vice-versa) * Apple device doesn't support Google passkeys, or vice-versa But it multiplies the following downsides: * Apple/Google account gets hacked, hacker gets all your 2FA credentials * Snooping on your activity. Particularly Google, but Apple also have an advertising business. * Setting up accounts on new sites is twice the hassle. * Too complicated for the kind of folks who need the phishing protection passkeys provide.
- rlpb 2y agoMany passkey-supporting sites only support a single passkey per account.
- growse 2y agoWhich?
- _Algernon_ 2y agoPaypal is one I've encountered.
- lxgr 2y agoPaypal, as far as I can tell, doesn't even (intentionally) support passkeys. They refer to all WebAuthN credentials as "security keys" and remind me to "plug it in and touch it now" etc. I'm honestly already glad that they didn't make their annoying browser fingerprinting rigorous enough to also block authentications and aren't requiring attestation.
- xjlin0 2y agoEven google account's MFA allows back up codes, at least in the Enterprise accounts.
- deleted 2y ago[deleted]
- kbolino 2y agoThis feels like the biggest misstep that may impede the success of passkeys to me. It's not that surprising, though, since it's pretty rare to find genuine support for multiple authentication factors of the same type already. You can usually only register one number for SMS, and/or one TOTP authenticator, etc. It seems like a lot of sites never really understood (or cared about) the benefits of MFA to the user and so can't be bothered to really understand passkeys either.
- skybrian 2y agoYes, this definitely needs to be fixed! Besides passkeys, some websites have alternative backup authentication, though, such as backup codes. However you do it, there should be an independent way to log in.
- compiler-guy 2y agoThe fact that the problem is solvable by technically savvy people doesn’t stop it from being a problem for the general user.
- tjoff 2y agoTo add an insanely unsatisfactory solution as well. Even passwords are better. Seriously.
- JadeNB 2y ago> I solve this by creating two passkeys for each account, for iOS and Chrome. This covers all the devices I might use to log in and there’s no single point of failure. This just seems to mean that, instead of being the whim of one corporation from being locked out of all your accounts, you're the whim of two corporations away. That's better, but I'd hardly call it solved.
- skybrian 2y ago“Google says no” is a threat model I’m concerned about, but it doesn’t seem particularly likely, so I’ll pick another passkey manager if it happens. (If it ever happened, Gmail and Google Photos would be a bigger loss.)
- deleted 2y ago[deleted]
- 1oooqooq 2y agocongrats. your problem is solved in the two or three places that actually allows or even implements any logic from N passkeys. on most places that will just give you a new account or wipe the first key.
- chrchr 2y agoReally? Which place allows passkey login and only allows one key per account?
- frereubu 2y agoI get that this this is a way to do it in practical terms, but isn't that just like having to have two passwords for each site (outside the fact that passkeys are a bit more secure than passwords)? I thought one of the main points of passkeys was to reduce admin.
- ghusto 2y agoDoes that mean you're locked into iOS and Chrome?
- marcosdumay 2y agoIf you can do that, you also have enough tech savyness to use passwords securely.
- patrakov 2y agoThe problem that passkeys solve is not that of their user. It is that of the website that authenticates its users. With mere passwords, there is no way they can be sure that the user follows the required password hygiene. With passkeys, there is no way a user could set up something insecure.
- theamk 2y agoAre we taling savvy users or regular users? Regular users would not set up double passkeys, and would suffer vendor lock. They would be better off with password manager instead. Savvy users know how to follow password hygiene, and have no need to have it enforced on them. So they don't need passkeys either, they would be better of with good password manager.
- patrakov 2y agoExactly what I am saying. Users don't need passkeys. Auditors and other guys from the checkbox compliance department on the opposite side do, for "security posture".
- fauigerzigerk 2y agoThe security of passwords doesn't just depend on users though. https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites
- xorcist 2y ago2FA does not protect against a website getting hacked.
- mapt 2y agoAt one point, a streamer on Youtube asked his audience something like "Spam F's in chat [to signal that you like this thing I just did]" Hundreds of users got banned by Youtube for spamming. But they didn't get banned from "Youtube". They got banned from "Google". They lost access to their Gmail, and to their Android login, and every other Google service, meaning they lost their phone text verification system for every other login, and quite possibly their password manager. Hundreds of identities were stolen and set on fire by an overly aggressive approach to spam management. I try to remember this failure mode in planning (or being unable to plan) the security of my online presence. Then I incorporate Elon Musk's recent behavior and recognize that while the profit motive _generally_ constrains the behavior of these firms, it's by no means assured. For basic social welfare, either this identity stuff needs to be heavily regulated or all of these big companies need to be broken up.
- 6510 2y agoEven without malice or incompetence you will have false positives and false negatives. Then when you attempt to correct the mistake you will have false positives and false negatives again.
- feoren 2y agoShould a false positive from the YouTube anti-spam algorithm accidentally temp-ban someone from commenting on YouTube for a week, or should it permanently and irrevocably destroy their online presence, possibly preventing them from logging into anything online: email, banking, government services, paying their mortgage? Because the whole problem is that we're in the universe where the latter happens.
- 6510 2y agoI see now how it sounds that way but I'm not making excuses. It was to describe the puzzle without all the emotional luggage. You need a system that gets it wrong, corrects it self then gets the correction wrong with infinite recursion. Instant judgement shooting from the hip without dialog or appeal is the dumbest way of doing things. Google isn't even trying.
- fishywang 2y ago>exposing yourself to the mercy of a single organization The nice thing about passkey is that unlike password, you can have multiple per account. So you can register a passkey from 1password to website A, and also register a passkey from Apple keychain to website A, and also register a passkey from Google account to website A, and also register a passkey from yubikey to website A, so even if you are locked out from one of your accounts, you still have several other ways to log into your account at website A. And _if_ your, say, Apple keychain is compromised, you can just revoke the passkeys from your Apple keychain from all the websites (yes it's tedious, but it's doable).
- efitz 2y agoHaving to have multiple passkeys per site to circumvent vendor identity lock-in is one of the main problems with passkeys.
- shim__ 2y agoI'd be so easy if this proposal were implemented: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco... one could always register one or more additional keys without having access to them.
- buran77 2y agoA door can be kicked in, a safe can be drilled, a password can be reset. But these keys (whether a phone or a Yubikey) to your digital life are irreplaceable if they're all lost. We've never been in this situation before. The problem with any solution relying on a couple of physical devices as the sole access to your digital life is that the management and protection of those objects becomes one of the most important things in your life. These keys are supposed to give perfect security so by design making "software" copies brings that security to the level of passwords. But losing them kills your digital life. You have two keys in the house and you have a fire or severe natural disaster? There's no reset for them and you just piled a tragedy on top of another. You want to restore them from a backup? You probably need the keys to begin with. People need one on them at all times, one at home, one or two in some other safe far away location but to still trust that they won't be misused there. That's all people hear when they look into passkeys. "One more key" is not enough for most people, tech savvy or not.