2 ms·

Fully admitting, I'm still learning about this topic. Also admitting that my current impression of the whole passkey system looks like a massively user-hostile

by xg15 1y ago

Fully admitting, I'm still learning about this topic. Also admitting that my current impression of the whole passkey system looks like a massively user-hostile and lock-in prone technology. But I have some questions to better understand it: - Suppose I'm a website owner and I handle authentication of my users with passkeys. Now for whatever reason, I want/have to move my site to a different domain. How would I "move" the passkeys, as they'd still be tied to the old domain? - Passkeys on Yubikeys or other dedicated hardware token sounds easy enough and mostly reasonable. (I could buy a bunch if yubikeys, copy the keys onto each of then and keep some if them as a backup in the drawer. The security properties of those seem a lot like regular keys or chip cards) Passkeys on phones or on cloud accounts much less so, but this is the main method that is promoted and expected to be used by "regular" users. But what happens if I have my passkeys stored in a Google account or whatever and then Google decides to ban me? Do I permanently lose access not just to all Google services but also to all services that had a passkey stored? - I have a set of passkeys on my phone and the phone gets stolen. Do I instantly lose access to all my services? Probably not, because the keys are still in the cloud, but then how do I authenticate to Google from a new device?

dfabulich 1y ago
Let me address your questions in reverse order. > I have a set of passkeys on my phone and the phone gets stolen. Do I instantly lose access to all my services? Probably not, because the keys are still in the cloud, but then how do I authenticate to Google from a new device? In general, logging into your password manager with a passkey is probably the least compelling way to use passkeys; you'll need some kinda backup code (i.e. a password) to avoid losing access to the password manager and the passkeys inside it. The company 1Password calls it that because, yes, you're probably going to need to memorize/retain one last password, the one you use to login to your password manager. If Google is your password manager, then, yeah, you're going to need something outside the password manager to login to the safe and get access to your passkeys and other passwords. You'll probably need to use a password for that. But https://myaccount.google.com/security https://myaccount.google.com/security lists a bunch of alternatives: • TOTP authenticator • Google prompt on multiple devices (login to YouTube on another machine? use that as a second factor) • Recovery email • Recovery phone • Backup codes (one-time passwords) If you lose your Google password, you'll have go through Google's password reset process. It can be hellish, but if you've set up backup codes and recovery contacts, you'll probably be fine. > But what happens if I have my passkeys stored in a Google account or whatever and then Google decides to ban me? Do I permanently lose access not just to all Google services but also to all services that had a passkey stored? Yeah, you lose access to your Google password/passkey safe when Google bans you. (It depends a little on how you got banned. If you're an identified persona non grata, sometimes they'll let you export some of your data with Google Takeout. If you're locked out of your account (because you lost your password and all of your other factors), well, of course you can't access your password safe at that point, because you can't prove your identity to Google.) If Google is your password safe, you really must set up backup codes, and you need to keep them safe. That's true regardless of whether you use Google passkeys or not. Either way, it sounds like maybe you don't want to trust Google as your password manager. It's perfectly reasonable to mistrust Google. There are a number of good alternative password managers that support passkeys; consider using them instead. > How would I "move" the passkeys, as they'd still be tied to the old domain? You can't really "move" passwords, either, because any phishing site could claim to be your site. ("We've moved! Please enter your password for example.com here. hehehe") But, while you control both sites, you could log people in on the old site and then redirect people over to your new site and let them create a new password/passkey there. But, if you're moving domains, you're probably just going to have to revalidate a significant fraction of your users, putting them through your "reset my password/passkey" flow. If your site does that with a "forgot my password" email, that's probably OK-ish.
- timmyc123 1y ago
  > How would I "move" the passkeys, as they'd still be tied to the old domain? You can also use a combination of Related Origin Requests[1], Conditional Create, and Signal API to allow the passkey for the old site to be used on your new site, automatically create a new passkey for the new domain, and optionally tell the user's credential manager that the old passkey is no longer valid. [1] https://passkeys.dev/docs/advanced/related-origins/ https://passkeys.dev/docs/advanced/related-origins/

by xg15 1y ago

dfabulich 1y ago

Let me address your questions in reverse order. > I have a set of passkeys on my phone and the phone gets stolen. Do I instantly lose access to all my services? Probably not, because the keys are still in the cloud, but then how do I authenticate to Google from a new device? In general, logging into your password manager with a passkey is probably the least compelling way to use passkeys; you'll need some kinda backup code (i.e. a password) to avoid losing access to the password manager and the passkeys inside it. The company 1Password calls it that because, yes, you're probably going to need to memorize/retain one last password, the one you use to login to your password manager. If Google is your password manager, then, yeah, you're going to need something outside the password manager to login to the safe and get access to your passkeys and other passwords. You'll probably need to use a password for that. But https://myaccount.google.com/security https://myaccount.google.com/security lists a bunch of alternatives: • TOTP authenticator • Google prompt on multiple devices (login to YouTube on another machine? use that as a second factor) • Recovery email • Recovery phone • Backup codes (one-time passwords) If you lose your Google password, you'll have go through Google's password reset process. It can be hellish, but if you've set up backup codes and recovery contacts, you'll probably be fine. > But what happens if I have my passkeys stored in a Google account or whatever and then Google decides to ban me? Do I permanently lose access not just to all Google services but also to all services that had a passkey stored? Yeah, you lose access to your Google password/passkey safe when Google bans you. (It depends a little on how you got banned. If you're an identified persona non grata, sometimes they'll let you export some of your data with Google Takeout. If you're locked out of your account (because you lost your password and all of your other factors), well, of course you can't access your password safe at that point, because you can't prove your identity to Google.) If Google is your password safe, you really must set up backup codes, and you need to keep them safe. That's true regardless of whether you use Google passkeys or not. Either way, it sounds like maybe you don't want to trust Google as your password manager. It's perfectly reasonable to mistrust Google. There are a number of good alternative password managers that support passkeys; consider using them instead. > How would I "move" the passkeys, as they'd still be tied to the old domain? You can't really "move" passwords, either, because any phishing site could claim to be your site. ("We've moved! Please enter your password for example.com here. hehehe") But, while you control both sites, you could log people in on the old site and then redirect people over to your new site and let them create a new password/passkey there. But, if you're moving domains, you're probably just going to have to revalidate a significant fraction of your users, putting them through your "reset my password/passkey" flow. If your site does that with a "forgot my password" email, that's probably OK-ish.

timmyc123 1y ago
> How would I "move" the passkeys, as they'd still be tied to the old domain? You can also use a combination of Related Origin Requests[1], Conditional Create, and Signal API to allow the passkey for the old site to be used on your new site, automatically create a new passkey for the new domain, and optionally tell the user's credential manager that the old passkey is no longer valid. [1] https://passkeys.dev/docs/advanced/related-origins/ https://passkeys.dev/docs/advanced/related-origins/