5 ms·

So... what happens with passkeys if you lose/break/someone_steals your phone? I'm talking about normal users, without backups.

tptacek 2y ago
The same thing that happens if you enroll in 2FA and lose your 2FA cred: you go into a complicated account recovery process. For this reason, at the huge providers, when you enable 2FA (or Passkeys) you usually have to set up a recovery buddy account or something like it.
- ajsnigrutin 2y ago
  But if that "buddy account" is 'passworded' by the same passkey device? Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes. I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.
  - throwaway31338 2y ago
    Until the passkey workflow goes sideways for "tech" people I don't think the risks will be acknowledged (if then even). Those of us who don't want the let Google, Apple, or Microsoft manage our passkeys (i.e. pledging our fealty to our lords) will be seen as fringe lunatics. I'll keep my workflow of always visiting sites by typing the URL myself, using a password manager, and TOTP 2FA w/ the secrets saved offline on paper. At least until I'm not allowed to do that anymore.
    - reddec 2y ago
      Luckily Bitwarden supports passkeys. And you can self host it. And even vaultwarden/bitwarden-rs supports passkeys
    - Nathanba 2y ago
      Same here, I don't like passkeys for many reasons. Another reason is that I can't see the key that I'm using. Therefore: What if Bitwarden doesn't pick up the passkey? Tough luck, I'm out of options. I cannot manually create a passkey entry in Bitwarden because it's all hidden magic. If I notice that the password manager doesn't pick up a registration then I just add it myself. Not possible with passkeys.
  - precommunicator 2y ago
    Easy if you're in the same country as the provider. Not so easy if you're on the other side of the planet.
  - aianus 2y ago
    Getting a SIM card is too easy, many millions have been lost to sim-jacking.
    - ajsnigrutin 2y ago
      In most countries, not really. Some countries have problems with people and IDs, like US, so that's a different story.
acdha 2y ago
All of the major implementations sync across all of your devices and use recovery codes as part of the setup process. Apple’s implementation is designed to cover loss of all devices, and I’d assume the others are similar: https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/web https://support.apple.com/guide/security/escrow-security-for... The key thing to understand is that passkeys are not intended to be as secure as hardware tokens but to be more secure than traditional passwords with phishing-friendly MFA. That allows them to offer better recovery options but might not be good enough if you are the target of a serious actor.
- leipert 2y ago
  What if the provider of the major implementation decides to shut you out of your account?
  - skybrian 2y ago
    Well, it's true that a password manager is a single point of failure. If you have two password managers then they can serve as backups for each other. Unfortunately that means you have to register each account twice.
    - precommunicator 2y ago
      Just use a password manager that allows you to have a local copy of everything (e.g. KeePass) and just back it up as any other file
      - skybrian 2y ago
        That could work, assuming your usual file backup methods are secure enough and it doesn't create a circular dependency.
        deleted 2y ago
        [deleted]
cryptbro 2y ago
Normal users have backups in the cloud. They also enable biometric so a stolen phone is no use. Even if stolen in a mugging.
mathematicaster 2y ago
they should have an activation factor that, e.g. bio or pin.
sureIy 2y ago
They're screwed, but that already happens. You have no idea how many people lose their phone or forget some password and just get a new phone/account, without trying to recover the old one. Parents who lost their child's photos and are like oh well. Assuming a normal user doesn't use the same password everywhere (which means everyone already knows their password), the alternative is saving them. Lost password or lost passkey doesn't make much difference. Computing literacy is low so people will just suffer the consequences.
deleted 2y ago
[deleted]

tptacek 2y ago

The same thing that happens if you enroll in 2FA and lose your 2FA cred: you go into a complicated account recovery process. For this reason, at the huge providers, when you enable 2FA (or Passkeys) you usually have to set up a recovery buddy account or something like it.

ajsnigrutin 2y ago
But if that "buddy account" is 'passworded' by the same passkey device? Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes. I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.
- throwaway31338 2y ago
  Until the passkey workflow goes sideways for "tech" people I don't think the risks will be acknowledged (if then even). Those of us who don't want the let Google, Apple, or Microsoft manage our passkeys (i.e. pledging our fealty to our lords) will be seen as fringe lunatics. I'll keep my workflow of always visiting sites by typing the URL myself, using a password manager, and TOTP 2FA w/ the secrets saved offline on paper. At least until I'm not allowed to do that anymore.
  - reddec 2y ago
    Luckily Bitwarden supports passkeys. And you can self host it. And even vaultwarden/bitwarden-rs supports passkeys
  - Nathanba 2y ago
    Same here, I don't like passkeys for many reasons. Another reason is that I can't see the key that I'm using. Therefore: What if Bitwarden doesn't pick up the passkey? Tough luck, I'm out of options. I cannot manually create a passkey entry in Bitwarden because it's all hidden magic. If I notice that the password manager doesn't pick up a registration then I just add it myself. Not possible with passkeys.
- precommunicator 2y ago
  Easy if you're in the same country as the provider. Not so easy if you're on the other side of the planet.
- aianus 2y ago
  Getting a SIM card is too easy, many millions have been lost to sim-jacking.
  - ajsnigrutin 2y ago
    In most countries, not really. Some countries have problems with people and IDs, like US, so that's a different story.

acdha 2y ago

All of the major implementations sync across all of your devices and use recovery codes as part of the setup process. Apple’s implementation is designed to cover loss of all devices, and I’d assume the others are similar: https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/web https://support.apple.com/guide/security/escrow-security-for... The key thing to understand is that passkeys are not intended to be as secure as hardware tokens but to be more secure than traditional passwords with phishing-friendly MFA. That allows them to offer better recovery options but might not be good enough if you are the target of a serious actor.

leipert 2y ago
What if the provider of the major implementation decides to shut you out of your account?
- skybrian 2y ago
  Well, it's true that a password manager is a single point of failure. If you have two password managers then they can serve as backups for each other. Unfortunately that means you have to register each account twice.
  - precommunicator 2y ago
    Just use a password manager that allows you to have a local copy of everything (e.g. KeePass) and just back it up as any other file
    - skybrian 2y ago
      That could work, assuming your usual file backup methods are secure enough and it doesn't create a circular dependency.
      - deleted 2y ago
        [deleted]

cryptbro 2y ago

Normal users have backups in the cloud. They also enable biometric so a stolen phone is no use. Even if stolen in a mugging.

mathematicaster 2y ago

they should have an activation factor that, e.g. bio or pin.

sureIy 2y ago

They're screwed, but that already happens. You have no idea how many people lose their phone or forget some password and just get a new phone/account, without trying to recover the old one. Parents who lost their child's photos and are like oh well. Assuming a normal user doesn't use the same password everywhere (which means everyone already knows their password), the alternative is saving them. Lost password or lost passkey doesn't make much difference. Computing literacy is low so people will just suffer the consequences.

deleted 2y ago

[deleted]