4 ms·

> To present a passkey, you have to use a password manager. This is what makes passkeys nonstarters for me.

aldshglkhdg 1y ago
that isn't true at all. i regularly use a yubikey as a passkey, and it's entirely orthogonal to any password manager i use. it happily just works on firefox on both mac and linux. to use a passkey, you need a place to store the passkey. that can be a hardware token, a tpm, or a password manager.
- deleted 1y ago
  [deleted]
- blindriver 1y ago
  What is someone steals your backpack with your laptop and all your yubikeys, your phone, etc? How do you get back your access?
  - dfedbeef 1y ago
    Don't keep all of your yubikeys and phones and laptops in one bag.
    - int_19h 1y ago
      Unfortunately, many services don't allow you to register multiple passkeys, so having a backup key that is stored somewhere safe is simply not an option.
      - chipsrafferty 1y ago
        That's why you have multiple passkeys that have the same key. It's a physical backup, not a software backup.
        crote 1y ago
        ... at which point you lose the whole "something you have" part of 2FA. If they all have the same key, it is impossible to distinguish between individual copies, so the compromise of a single copy is impossible to detect. Additionally, you can't revoke a single copy: you are now forced to revoke all of them at once.
        xg15 1y ago
        > Unfortunately, many services don't allow you to register multiple passkeys Doesn't this already make that scenario a nonstarter? I can't revoke individual keys if I can only register one key in the first place.
        esseph 1y ago
        You can revoke individual ones.
        rcxdude 1y ago
        Is that what you have set up? Can you describe how you do it in more detail? I'm looking for an option like this but everything I've found seems to suggest it's not possible (or at the very least wildly impractical). I'm looking for something where it's at least possible to make a physical backup that's still relatively secure.
      - dfedbeef 1y ago
        You only need multiple on your recovery email. Unless you're using Yahoo or running your own email server, this is an option.
        dfedbeef 1y ago
        It might be possible to set it up on a home server idk. I would rather waste my time on other stupid things.
      - esseph 1y ago
        I have 5 in Google.
    - blindriver 1y ago
      That doesn’t answer the question, unless it means you’re SOL. If that’s the case why on earth would I prefer passkeys to regular passwords as long as I practice safe password handling?
      - dfedbeef 1y ago
        Do whatever you want. It's easier for me to have a primary recovery email and password manager with MFA that uses a yubikey and phone authenticator. Then I can use passkeys or whatever for the rest of the stupid accounts that I don't care about. Side note: I feel like people always say 'i can just use good passwords' and then their password is like '<sports reference><year>'
  - chipsrafferty 1y ago
    Don't bring anythng you really wouldn't want to get stolen anywhere outside of your house.
    - blindriver 1y ago
      What if your house burns down with all your contents? My point being, there is a reasonable limit to how many physical passkeys a person would make but there’s also a non-zero possibility that a physical catastrophe could occur that destroys all the passkeys. What happens in that case? Can you recover your accounts?
      - tzs 1y ago
        Most sites currently have you create your account with a password, and then later you can add passkeys. If you still have your passwords after your house burns down you can use those to get into sites. If your house burning down also wiped out wherever you store your passwords, you'd use whatever mechanism each site provides for recovering from a lost password.
- JohnFen 1y ago
  Yubikeys are an even worse solution, in my opinion. They dramatically increase the amount of hassle and maintenance required because you have to have multiples of them to ensure that you won't get locked out. Also, it's not always convenient or possible to plug something into a machine you're using. > to use a passkey, you need a place to store the passkey. Yes, and any place that requires me to use particular piece of software, machine, or device is a real friction point for me.
dylan604 1y ago
Are you not already using password manager for all of your passwords? It took forever to make any movement towards getting people to stop using the same password every where. Now we're telling people passwords aren't secure even with using a password manager and they should use passkeys. So now we're saying that using the same software that we spent so much time suggesting to use is not good enough. Instead, now you want them to use a dedicated piece of hardware that needs to never be lost, but people lose their phones frequently. It's amazing to me how the majority of readers here absolutely cannot put themself in the place of non-computer nerds that spend 0% of their day thinking about code/security or anything other than what the Kardashiens are doing or their favorite influencer or whatever other nonsense that is everything and not nonsense to them. It's this kind of thinking that put us in this position that the people building the thing can't think about how the users will actually use it
- XorNot 1y ago
  That's not the problem: the problem is if I change password managers, or move software or any of many other possible things, whereas with password I can just type them into the new thing in the worst case...passkeys are wholly opaque. The ability to migrate them was considered an optional feature and not implemented before they were launched. It's still wholly unclear whether any individual implementation will let you do that or not, with options to prevent it.
  - dylan604 1y ago
    Again, it's us nerds making thing that didn't make it well enough that it causes pain on the end users. Not really sure how that's not the problem.
    - porridgeraisin 1y ago
      Standards/specs set incentives which uniquely decide implementation quality. If after many years implementations backed by a variety of funding and brains _all_ suck, then it's the standard/spec's problem.
- 1y ago
chipsrafferty 1y ago
It's not true at all. Not many apps support passkeys, but for the ones that do, it's a godsend. No longer do I have to worry about whether my password is stored in Google, or Firefox, or if it's up to date, or what happens if I get hacked. I just plug my little key into the computer and tap it. It's like having a physical key instead of having your password written in a page of an obscure book in the library. Probably safe, but someone dedicated can find it. A physical key can only be taken if my house gets robbed.
- eviks 1y ago
  > No longer do I have to worry about whether my password is stored in Google, or Firefox You never have too worry about it with a password manager, and also don't need to worry whether your key is plugged in in the computer you're currently using
- rcxdude 1y ago
  > No longer do I have to worry about whether my password is stored in Google, or Firefox Once Google and Firefox start pushing their passkey implementation, you do. One issue with them is user confusion about where the passkey is stored. And do you have a backup solution for if you lose your physical key? That's the big problem I have in practice at the moment: I would like a physical device for storing credentials, but I 100% cannot have it as a single point of failure. Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them!.
  - tzs 1y ago
    > Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them! • You can use multiple independent cloud sync vendors. When I add passkeys to an account I add two passkeys. One gets stored in 1Password and synced using their cloud. The other gets stored in Apple's Password and synced using Apple's cloud. This should give you enough redundancy to mitigate most vendor lock-in concerns. • If using devices that don't cloud sync I don't see why your would need to carry around two devices in order to enroll two devices. Carry around one device, and when you make a new account create a passkey for that account stored in the device. Later, back home, login into any accounts you created while away using the passkeys on the device you were carrying, and create a second passkey on each of those accounts and store it on the other device.
esseph 1y ago
How do you plan to sync your passkey between devices? Another feature of the password manager.

that isn't true at all. i regularly use a yubikey as a passkey, and it's entirely orthogonal to any password manager i use. it happily just works on firefox on both mac and linux. to use a passkey, you need a place to store the passkey. that can be a hardware token, a tpm, or a password manager.

deleted 1y ago
[deleted]
blindriver 1y ago
What is someone steals your backpack with your laptop and all your yubikeys, your phone, etc? How do you get back your access?
- dfedbeef 1y ago
  Don't keep all of your yubikeys and phones and laptops in one bag.
  - int_19h 1y ago
    Unfortunately, many services don't allow you to register multiple passkeys, so having a backup key that is stored somewhere safe is simply not an option.
    - chipsrafferty 1y ago
      That's why you have multiple passkeys that have the same key. It's a physical backup, not a software backup.
      - crote 1y ago
        ... at which point you lose the whole "something you have" part of 2FA. If they all have the same key, it is impossible to distinguish between individual copies, so the compromise of a single copy is impossible to detect. Additionally, you can't revoke a single copy: you are now forced to revoke all of them at once.
        xg15 1y ago
        > Unfortunately, many services don't allow you to register multiple passkeys Doesn't this already make that scenario a nonstarter? I can't revoke individual keys if I can only register one key in the first place.
        esseph 1y ago
        You can revoke individual ones.
      - rcxdude 1y ago
        Is that what you have set up? Can you describe how you do it in more detail? I'm looking for an option like this but everything I've found seems to suggest it's not possible (or at the very least wildly impractical). I'm looking for something where it's at least possible to make a physical backup that's still relatively secure.
    - dfedbeef 1y ago
      You only need multiple on your recovery email. Unless you're using Yahoo or running your own email server, this is an option.
      - dfedbeef 1y ago
        It might be possible to set it up on a home server idk. I would rather waste my time on other stupid things.
    - esseph 1y ago
      I have 5 in Google.
  - blindriver 1y ago
    That doesn’t answer the question, unless it means you’re SOL. If that’s the case why on earth would I prefer passkeys to regular passwords as long as I practice safe password handling?
    - dfedbeef 1y ago
      Do whatever you want. It's easier for me to have a primary recovery email and password manager with MFA that uses a yubikey and phone authenticator. Then I can use passkeys or whatever for the rest of the stupid accounts that I don't care about. Side note: I feel like people always say 'i can just use good passwords' and then their password is like '<sports reference><year>'
- chipsrafferty 1y ago
  Don't bring anythng you really wouldn't want to get stolen anywhere outside of your house.
  - blindriver 1y ago
    What if your house burns down with all your contents? My point being, there is a reasonable limit to how many physical passkeys a person would make but there’s also a non-zero possibility that a physical catastrophe could occur that destroys all the passkeys. What happens in that case? Can you recover your accounts?
    - tzs 1y ago
      Most sites currently have you create your account with a password, and then later you can add passkeys. If you still have your passwords after your house burns down you can use those to get into sites. If your house burning down also wiped out wherever you store your passwords, you'd use whatever mechanism each site provides for recovering from a lost password.
JohnFen 1y ago
Yubikeys are an even worse solution, in my opinion. They dramatically increase the amount of hassle and maintenance required because you have to have multiples of them to ensure that you won't get locked out. Also, it's not always convenient or possible to plug something into a machine you're using. > to use a passkey, you need a place to store the passkey. Yes, and any place that requires me to use particular piece of software, machine, or device is a real friction point for me.

dylan604 1y ago

Are you not already using password manager for all of your passwords? It took forever to make any movement towards getting people to stop using the same password every where. Now we're telling people passwords aren't secure even with using a password manager and they should use passkeys. So now we're saying that using the same software that we spent so much time suggesting to use is not good enough. Instead, now you want them to use a dedicated piece of hardware that needs to never be lost, but people lose their phones frequently. It's amazing to me how the majority of readers here absolutely cannot put themself in the place of non-computer nerds that spend 0% of their day thinking about code/security or anything other than what the Kardashiens are doing or their favorite influencer or whatever other nonsense that is everything and not nonsense to them. It's this kind of thinking that put us in this position that the people building the thing can't think about how the users will actually use it

XorNot 1y ago
That's not the problem: the problem is if I change password managers, or move software or any of many other possible things, whereas with password I can just type them into the new thing in the worst case...passkeys are wholly opaque. The ability to migrate them was considered an optional feature and not implemented before they were launched. It's still wholly unclear whether any individual implementation will let you do that or not, with options to prevent it.
- dylan604 1y ago
  Again, it's us nerds making thing that didn't make it well enough that it causes pain on the end users. Not really sure how that's not the problem.
  - porridgeraisin 1y ago
    Standards/specs set incentives which uniquely decide implementation quality. If after many years implementations backed by a variety of funding and brains _all_ suck, then it's the standard/spec's problem.
1y ago

chipsrafferty 1y ago

It's not true at all. Not many apps support passkeys, but for the ones that do, it's a godsend. No longer do I have to worry about whether my password is stored in Google, or Firefox, or if it's up to date, or what happens if I get hacked. I just plug my little key into the computer and tap it. It's like having a physical key instead of having your password written in a page of an obscure book in the library. Probably safe, but someone dedicated can find it. A physical key can only be taken if my house gets robbed.

eviks 1y ago
> No longer do I have to worry about whether my password is stored in Google, or Firefox You never have too worry about it with a password manager, and also don't need to worry whether your key is plugged in in the computer you're currently using
rcxdude 1y ago
> No longer do I have to worry about whether my password is stored in Google, or Firefox Once Google and Firefox start pushing their passkey implementation, you do. One issue with them is user confusion about where the passkey is stored. And do you have a backup solution for if you lose your physical key? That's the big problem I have in practice at the moment: I would like a physical device for storing credentials, but I 100% cannot have it as a single point of failure. Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them!.
- tzs 1y ago
  > Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them! • You can use multiple independent cloud sync vendors. When I add passkeys to an account I add two passkeys. One gets stored in 1Password and synced using their cloud. The other gets stored in Apple's Password and synced using Apple's cloud. This should give you enough redundancy to mitigate most vendor lock-in concerns. • If using devices that don't cloud sync I don't see why your would need to carry around two devices in order to enroll two devices. Carry around one device, and when you make a new account create a passkey for that account stored in the device. Later, back home, login into any accounts you created while away using the passkeys on the device you were carrying, and create a second passkey on each of those accounts and store it on the other device.

esseph 1y ago

How do you plan to sync your passkey between devices? Another feature of the password manager.