2 ms·
The same way you recover your account when you lose a password.
by karlshea 16d ago
The same way you recover your account when you lose a password.
- marcosdumay 16d agoWhat benefit does your 128-bits authentication schema gain when anybody can just clone a phone number? Or do you demand that the user has an email with that 128-bits authn too, with a key on the same phone that was lost?
- flerchin 16d agoI don't get it. I recover an account at ticketmaster by receiving an email. I recover an account at google by???
- karlshea 16d agoReceiving an email at your backup email address? Getting a text message? It’s whatever you have decided to set up in your account, the same as with a password.
- flerchin 15d agoI think the point with a passkey is that those very loose backup methods are required, since just knowing the password is not a thing. Everyone gets a new phone and is at risk of the previous one being unavailable. So passkeys mean that there's no way to deal with that reality, and also be truly secure.
- karlshea 15d agoI don’t know any of my passwords and haven’t for a decade, so passkeys are no different in that respect. If the worry is your phone getting lost then use a password manager that syncs to the cloud and log in with the same passkey using another device. I just got a new iPhone and logged into a bunch of things on-device using synced passkeys. It worked just fine. Every conversation about this seems to involve someone asserting that improving upon passwords in any way at all is unacceptable unless the solution is perfect in every possible way, with the goalposts constantly moving.