3 ms·

>Something as innocent and common as losing a phone could result in complete account lockout. This is the biggest misconception I see repeated about passkeys c

>Something as innocent and common as losing a phone could result in complete account lockout. This is the biggest misconception I see repeated about passkeys constantly. Account recovery flows generally do not change at all. Passkeys replace passwords, they change nothing at all about account recovery. If you forget/lose your password or your passkey, you go through the reset flow and create a new one.

saagarjha 2y ago
If you lose your phone you may also have lost access to your email, if you used a passkey to sign into that.
- deleted 2y ago
  [deleted]
- pilif 2y ago
  If you lose your phone and you only have your phone to access your email, then you also have lost access to your password if you're using a strong password and a password manager. Or do you remember a 20+ random character string for each site and thus do not need a password manager?
  - Macha 2y ago
    My email and password manager are actually the two unique passwords I do remember (the rest are in my password manager). So losing my phone does not mean I lose access to them. I _have_ actually lost all my electronic devices in a house fire, so this is from experience. 2FA does make this more complicated and in my case my password manager did not have 2FA, but TOTP with backup codes does let you store those backup codes somewhere else, while none of the passkey implementations I have seen (Fastmail, Amazon and Toggl) have an equivalent to the backup codes for TOTP. The fact that they still support password auth is probably their failsafe here, but this assumes that password auth continues to exist, which is contrary to to the goals of passkeys.
    - jesseendahl 2y ago
      >I _have_ actually lost all my electronic devices in a house fire, so this is from experience. I can't speak to other passkey managers, but both Google and Apple have pretty thorough account recovery flows that work even if you lose 100% of your devices.
      - saagarjha 2y ago
        Google regularly asks me for annoying things even when I have all my credentials. What’s their account recovery flow? I’m not sure I trust it to be good.
        jesseendahl 2y ago
        I just had to go through it for a friend who had forgotten their Google password. It was good. Tbh it would be more surprising if it was bad since they have millions of users. So the amount of people who go through that flow every day is probably very high in terms of absolutes numbers, even if it’s only a small percentage of users. And Google is known to do a shitload of A/B testing anytime they tweak their UI/UX. So yeah I think it would be way more surprising to me if this particular flow was bad. If anything it’s likely to be one of their _best_ flows, given their scale and how critical of a flow it is. And given that they love to track users to serve them ads, it’s also very much in their (capitalist) interest to make sure users don’t get locked out of their accounts.
      - Macha 2y ago
        That has not been my experience with Google, as detailed in the other time you sent this reply.
- scarfaceneo 2y ago
  That’s why you don’t create a passkey for the service that manages your credentials. Use a pair of yubikeys. BTW, all major email providers have a flow to allow you to recover access to your account. When you enable passkeys it doesn’t suddenly deactivate every other way of logging in.
  - saagarjha 2y ago
    That’s definitely not the position most passkey proponents take.
oefrha 2y ago
If I lose my phone I don’t lose my passwords to begin with, because I have my most important account passwords written down somewhere, including the one for the email account used for recovery flows. Strings are an open system after all. TOTPs are slightly more involved but even a layperson can save an image of the original QR code, in addition to recovery codes. The misconception here is your setting up a strawman.
- corford 2y ago
  Password managers like Bitwarden allow you to store passkeys too. Ofc, that only works for services that let you create & use your own passkey, rather than force you to use one managed by them.
- fragmede 2y ago
  Is the strawman that passkey are only available via one device, your phone? Because Google and Apple sync passkeys to devices logged into their respective accounts, so assuming you own a laptop or ipad/tablet, or have an old phone, your passkeys are also available on that device.
  - Macha 2y ago
    Except if you're relying on "an old phone" as your backup device, you'll find you don't have access because you haven't powered it on to sync passkeys, and Google expired your login anyway as you haven't used it on that device in months.
    - jesseendahl 2y ago
      FYI both Google and Apple have an account recovery flow that works even if you lose 100% of your devices.
      - oefrha 2y ago
        I once used Google’s account recovery flow on an old dormant (for maybe three years?) account. Did everything asked and reached a state where they wouldn’t ask me to do anything else to demonstrate ownership but I’m still suspicious or something like that. Fortunately I had nothing important there. Pro tip: operate as if Google doesn’t have a recovery flow at all.

saagarjha 2y ago

If you lose your phone you may also have lost access to your email, if you used a passkey to sign into that.

deleted 2y ago
[deleted]
pilif 2y ago
If you lose your phone and you only have your phone to access your email, then you also have lost access to your password if you're using a strong password and a password manager. Or do you remember a 20+ random character string for each site and thus do not need a password manager?
- Macha 2y ago
  My email and password manager are actually the two unique passwords I do remember (the rest are in my password manager). So losing my phone does not mean I lose access to them. I _have_ actually lost all my electronic devices in a house fire, so this is from experience. 2FA does make this more complicated and in my case my password manager did not have 2FA, but TOTP with backup codes does let you store those backup codes somewhere else, while none of the passkey implementations I have seen (Fastmail, Amazon and Toggl) have an equivalent to the backup codes for TOTP. The fact that they still support password auth is probably their failsafe here, but this assumes that password auth continues to exist, which is contrary to to the goals of passkeys.
  - jesseendahl 2y ago
    >I _have_ actually lost all my electronic devices in a house fire, so this is from experience. I can't speak to other passkey managers, but both Google and Apple have pretty thorough account recovery flows that work even if you lose 100% of your devices.
    - saagarjha 2y ago
      Google regularly asks me for annoying things even when I have all my credentials. What’s their account recovery flow? I’m not sure I trust it to be good.
      - jesseendahl 2y ago
        I just had to go through it for a friend who had forgotten their Google password. It was good. Tbh it would be more surprising if it was bad since they have millions of users. So the amount of people who go through that flow every day is probably very high in terms of absolutes numbers, even if it’s only a small percentage of users. And Google is known to do a shitload of A/B testing anytime they tweak their UI/UX. So yeah I think it would be way more surprising to me if this particular flow was bad. If anything it’s likely to be one of their _best_ flows, given their scale and how critical of a flow it is. And given that they love to track users to serve them ads, it’s also very much in their (capitalist) interest to make sure users don’t get locked out of their accounts.
    - Macha 2y ago
      That has not been my experience with Google, as detailed in the other time you sent this reply.
scarfaceneo 2y ago
That’s why you don’t create a passkey for the service that manages your credentials. Use a pair of yubikeys. BTW, all major email providers have a flow to allow you to recover access to your account. When you enable passkeys it doesn’t suddenly deactivate every other way of logging in.
- saagarjha 2y ago
  That’s definitely not the position most passkey proponents take.

oefrha 2y ago

If I lose my phone I don’t lose my passwords to begin with, because I have my most important account passwords written down somewhere, including the one for the email account used for recovery flows. Strings are an open system after all. TOTPs are slightly more involved but even a layperson can save an image of the original QR code, in addition to recovery codes. The misconception here is your setting up a strawman.

corford 2y ago
Password managers like Bitwarden allow you to store passkeys too. Ofc, that only works for services that let you create & use your own passkey, rather than force you to use one managed by them.
fragmede 2y ago
Is the strawman that passkey are only available via one device, your phone? Because Google and Apple sync passkeys to devices logged into their respective accounts, so assuming you own a laptop or ipad/tablet, or have an old phone, your passkeys are also available on that device.
- Macha 2y ago
  Except if you're relying on "an old phone" as your backup device, you'll find you don't have access because you haven't powered it on to sync passkeys, and Google expired your login anyway as you haven't used it on that device in months.
  - jesseendahl 2y ago
    FYI both Google and Apple have an account recovery flow that works even if you lose 100% of your devices.
    - oefrha 2y ago
      I once used Google’s account recovery flow on an old dormant (for maybe three years?) account. Did everything asked and reached a state where they wouldn’t ask me to do anything else to demonstrate ownership but I’m still suspicious or something like that. Fortunately I had nothing important there. Pro tip: operate as if Google doesn’t have a recovery flow at all.