4 ms·

Same with passkeys actually.

• SchemaLoad 10mo ago
  Passkeys get synced between your devices so they aren't any more fragile than passwords in a password manager.
  • lsowen 10mo ago
    Passkeys _may_ be synced, but that isn't guaranteed. For example a "device bound passkey" isn't synced.
    • tadfisher 10mo ago
      There is a project under way to specify how to "sync" device-bound keys between authenticators: https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html Ideally this should have been hashed out before deploying passkeys everywhere, but I guess you can always register multiple passkeys for the sites that allow you to.
      • nottorp 10mo ago
        Iirc the original idea was that passkeys should be device specific. Of course that's impractical so now they're morphing to a long password that a human can't process. In a few years someone will post "how about a long human retainable passphrase?" as a new and improved discovery.
        • SchemaLoad 10mo ago
          They are still different to a password in that the service you are logging in to never gets the private key. So in the case the database gets compromised, if the service provider ensures no edits were made / restores a backup, there is no need to change your passkey since it was never exposed.
          • yencabulator 10mo ago
            That was possible before passkeys. https://www.rfc-editor.org/rfc/rfc9807.html https://www.rfc-editor.org/rfc/rfc9807.html https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr...
  • 0cf8612b2e1e 10mo ago
    The big providers only want themselves to be able to backup passkeys. I do not want to handover my secrets to Apple/Microsoft/Google.
    • lilyball 10mo ago
      Apple Keychain syncing is end-to-end encrypted, Apple cannot see the contents of your synced keychain.