3 ms·

What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you'r

by tavavex 15d ago

What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival. These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.

limagnolia 15d ago
If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.
- horsawlarway 15d ago
  > But I am curious why one would need to login to a website in order to survive? They use bank like Ally or Discover with no physical branches. They use a mortgage provider like Rocket mortgage with no physical branches. They use a medication delivery service with no physical customer facing pharmacies. They have an employer that only facilitates reimbursement for expenses via online tools. etc... I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts. And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method" Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
- epihelix 15d ago
  If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost. What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
  - AlienRobot 15d ago
    What confuses me is that for a long while we told people to not write their passwords on a sticky note, to not write them in plain text somewhere. Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes. Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note. Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them. It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.
    - dwaite 15d ago
      FWIW my break-the-glass actual use of backup codes is for access to my password manager. Everything else which has ever given me a backup code... gets stored in a secure note in my password manager. It is just another knowledge-based factor. It is one that they are reasonably sure you aren't spreading around the internet. It is one that the site gets to pick rather than the user. But in reality, they are a often just a way to try to reduce some support and identity verification costs. The path to get to the password manager is the case where the backup codes truly matter, because without them there may not be a way for support to restore access. Those codes may be your only way of regaining the master encryption key. But that also winds up being part of the trade-off of security vs user friendliness. Some password managers are way easier to get back into.
- tavavex 15d ago
  Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you. When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.
deleted 15d ago
[deleted]
vel0city 15d ago
Passkeys can exist on devices other than phones, so your entire premise is moot.
- tavavex 15d ago
  What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
  - vel0city 15d ago
    > I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services. And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords. Aren't passkeys great?
    - pixl97 15d ago
      You go to country X (USA sounds good to put in here). You get mugged. They take your phone and keyring. They can't do anything with it since it's locked, but you don't have it. Aren't passkeys great?
      - jazzyjackson 15d ago
        They can’t do anything with it I have a backup key at home Mission accomplished
kyleee 15d ago
I think there exists a vein of contempt for anyone not fully embracing our bold new world, so many implementers etc. get the double bonus of alienating and frustrating all of the non conformers

by tavavex 15d ago

limagnolia 15d ago

If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.

horsawlarway 15d ago
> But I am curious why one would need to login to a website in order to survive? They use bank like Ally or Discover with no physical branches. They use a mortgage provider like Rocket mortgage with no physical branches. They use a medication delivery service with no physical customer facing pharmacies. They have an employer that only facilitates reimbursement for expenses via online tools. etc... I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts. And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method" Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
epihelix 15d ago
If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost. What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
- AlienRobot 15d ago
  What confuses me is that for a long while we told people to not write their passwords on a sticky note, to not write them in plain text somewhere. Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes. Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note. Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them. It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.
  - dwaite 15d ago
    FWIW my break-the-glass actual use of backup codes is for access to my password manager. Everything else which has ever given me a backup code... gets stored in a secure note in my password manager. It is just another knowledge-based factor. It is one that they are reasonably sure you aren't spreading around the internet. It is one that the site gets to pick rather than the user. But in reality, they are a often just a way to try to reduce some support and identity verification costs. The path to get to the password manager is the case where the backup codes truly matter, because without them there may not be a way for support to restore access. Those codes may be your only way of regaining the master encryption key. But that also winds up being part of the trade-off of security vs user friendliness. Some password managers are way easier to get back into.
tavavex 15d ago
Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you. When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.

deleted 15d ago

[deleted]

vel0city 15d ago

Passkeys can exist on devices other than phones, so your entire premise is moot.

tavavex 15d ago
What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
- vel0city 15d ago
  > I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services. And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords. Aren't passkeys great?
  - pixl97 15d ago
    You go to country X (USA sounds good to put in here). You get mugged. They take your phone and keyring. They can't do anything with it since it's locked, but you don't have it. Aren't passkeys great?
    - jazzyjackson 15d ago
      They can’t do anything with it I have a backup key at home Mission accomplished

kyleee 15d ago

I think there exists a vein of contempt for anyone not fully embracing our bold new world, so many implementers etc. get the double bonus of alienating and frustrating all of the non conformers