4 ms·

What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happe

What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.

vel0city 8d ago
> I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services. And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords. Aren't passkeys great?
- pixl97 8d ago
  You go to country X (USA sounds good to put in here). You get mugged. They take your phone and keyring. They can't do anything with it since it's locked, but you don't have it. Aren't passkeys great?
  - jazzyjackson 8d ago
    They can’t do anything with it I have a backup key at home Mission accomplished
    - rcxdude 8d ago
      Do you have a plan for getting home without access to any of your accounts? And one of the problems with passkeys is that it's unreasonably difficult to keep a backup key.
      - pixl97 8d ago
        You're asking way too much foresight in this thread I guess. There are some people who have lived lives without any series of unfortunate events, they can't even imagine what the world can serve up.
      - dwaite 7d ago
        I've done a mock "what if I wake up naked in Tokyo" for my own recovery several times, mostly because I keep things really tied down. I have not yet done an actual test within Japan, however.
      - realityking 7d ago
        If nearby (some country) any credit card or even my ID card will get me home. I can walk into a branch of my bank and - with some waiting and paper work - I should be able to get enough cash to get myself home. Abroad I’d head to the nearest consulate of my home country. Might be difficult to get to if it’s in a far away city. Hard to prepare for abstractly.
    - mrweasel 8d ago
      But the problem is that you can't really backup passkeys and because people are frankly frequent tricked into using them, they have no good recovery options. I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't. My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
      - pixl97 8d ago
        > designed for a reality that don't exist They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
      - vel0city 8d ago
        > But the problem is that you can't really backup passkeys The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords. To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever, or figure out some way to get me money to get home. Chances are I'll end up having to work with the embassy anyway. > My issue with passkeys are that they are designed for a reality that don't exist The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people. > I know plenty of people who only have a phone, no other devices. And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways.
        8d ago
    - tavavex 8d ago
      Great, now I just need to get back home to use my uncompromised accounts (which would have still been protected by my device as long as the thieves aren't NSO Group, but whatever). Gee, it seems my tickets back home were taken with my stolen phone! Not to worry, they sent me an email confirmation, so all I need to do is log into my passkey-protected email on my friend's phone and have them download my ticket in addition to theirs, or print them at a public computer. Oh wait
      - realityking 7d ago
        As long as you still have your passport, which you’d need for international travel anyway, you can get your boarding pass at the airport without any hassle.
  - staticman2 8d ago
    Wouldn't I have the same problem with passwords? I would lose my phone and be unable to two factor log in to my Gmail account or bank from someone else's device?
    - pixl97 8d ago
      A passkey or a 2FA requiring a non-trivial device are functionally equivalent. Passkeys and app driven 2FA are the same when shit goes bad.
    - TeMPOraL 8d ago
      With passwords? No. With 2FA? Yes. 2FA is almost just as stupid and almost just as bad for regular users as passkeys are, but it got adopted due to historical loophole - by far the most popular form was TOTP delivered via SMS, then "authenticator" apps, both of which keep the code transferable - you can receive it on one device, transfer to yourself or someone else (which is a feature, not a bug) via any channel, and get it to work. Passkeys were created specifically to close that loophole. Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
      - dwaite 7d ago
        I have over 2,000 accounts. The majority of them have unique passwords. I can count the services that have passwords that I know on one hand, with quite a few spare fingers. Passwords just don't provide a broad recoverability benefit once you commit to doing strong, unique passwords. > Passkeys were created specifically to close that loophole. Credential sharing? I have a family share with passwords and passkeys in it. Passkeys most certainly didn't stop this. They did add friction to having a user being duped to share their password to someone claiming to be tech support, since you can no longer request plaintext secrets be sent over arbitrary channels. > Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users). SMS is an ugly user experience and more importantly is expensive. Now a lot of services do emailed codes when they don't have a regulatory reason to require SMS - an even worse user experience, but less expensive. We have authenticator apps which use a standard OATH setup, and quite a few platforms which have integrated support to try to sand over the worst part of the UX. Unfortunately they just didn't become popular, and OATH fails the same regulatory requirements that emailed codes fail. Passkeys are not meant to have a vendor lock-in story. Credential exchange allows for credentials stored in consumer credential managers to be imported into another credential managers. The platforms have added infrastructure specifically to make this easier for users. The exceptions are when enterprises run their own passkey stores, or when the user explicitly picks a solution that doesn't allow export (like a physical Yubikey).

vel0city 8d ago

> I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services. And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords. Aren't passkeys great?

pixl97 8d ago
You go to country X (USA sounds good to put in here). You get mugged. They take your phone and keyring. They can't do anything with it since it's locked, but you don't have it. Aren't passkeys great?
- jazzyjackson 8d ago
  They can’t do anything with it I have a backup key at home Mission accomplished
  - rcxdude 8d ago
    Do you have a plan for getting home without access to any of your accounts? And one of the problems with passkeys is that it's unreasonably difficult to keep a backup key.
    - pixl97 8d ago
      You're asking way too much foresight in this thread I guess. There are some people who have lived lives without any series of unfortunate events, they can't even imagine what the world can serve up.
    - dwaite 7d ago
      I've done a mock "what if I wake up naked in Tokyo" for my own recovery several times, mostly because I keep things really tied down. I have not yet done an actual test within Japan, however.
    - realityking 7d ago
      If nearby (some country) any credit card or even my ID card will get me home. I can walk into a branch of my bank and - with some waiting and paper work - I should be able to get enough cash to get myself home. Abroad I’d head to the nearest consulate of my home country. Might be difficult to get to if it’s in a far away city. Hard to prepare for abstractly.
  - mrweasel 8d ago
    But the problem is that you can't really backup passkeys and because people are frankly frequent tricked into using them, they have no good recovery options. I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't. My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
    - pixl97 8d ago
      > designed for a reality that don't exist They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
    - vel0city 8d ago
      > But the problem is that you can't really backup passkeys The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords. To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever, or figure out some way to get me money to get home. Chances are I'll end up having to work with the embassy anyway. > My issue with passkeys are that they are designed for a reality that don't exist The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people. > I know plenty of people who only have a phone, no other devices. And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways.
      - 8d ago
  - tavavex 8d ago
    Great, now I just need to get back home to use my uncompromised accounts (which would have still been protected by my device as long as the thieves aren't NSO Group, but whatever). Gee, it seems my tickets back home were taken with my stolen phone! Not to worry, they sent me an email confirmation, so all I need to do is log into my passkey-protected email on my friend's phone and have them download my ticket in addition to theirs, or print them at a public computer. Oh wait
    - realityking 7d ago
      As long as you still have your passport, which you’d need for international travel anyway, you can get your boarding pass at the airport without any hassle.
- staticman2 8d ago
  Wouldn't I have the same problem with passwords? I would lose my phone and be unable to two factor log in to my Gmail account or bank from someone else's device?
  - pixl97 8d ago
    A passkey or a 2FA requiring a non-trivial device are functionally equivalent. Passkeys and app driven 2FA are the same when shit goes bad.
  - TeMPOraL 8d ago
    With passwords? No. With 2FA? Yes. 2FA is almost just as stupid and almost just as bad for regular users as passkeys are, but it got adopted due to historical loophole - by far the most popular form was TOTP delivered via SMS, then "authenticator" apps, both of which keep the code transferable - you can receive it on one device, transfer to yourself or someone else (which is a feature, not a bug) via any channel, and get it to work. Passkeys were created specifically to close that loophole. Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
    - dwaite 7d ago
      I have over 2,000 accounts. The majority of them have unique passwords. I can count the services that have passwords that I know on one hand, with quite a few spare fingers. Passwords just don't provide a broad recoverability benefit once you commit to doing strong, unique passwords. > Passkeys were created specifically to close that loophole. Credential sharing? I have a family share with passwords and passkeys in it. Passkeys most certainly didn't stop this. They did add friction to having a user being duped to share their password to someone claiming to be tech support, since you can no longer request plaintext secrets be sent over arbitrary channels. > Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users). SMS is an ugly user experience and more importantly is expensive. Now a lot of services do emailed codes when they don't have a regulatory reason to require SMS - an even worse user experience, but less expensive. We have authenticator apps which use a standard OATH setup, and quite a few platforms which have integrated support to try to sand over the worst part of the UX. Unfortunately they just didn't become popular, and OATH fails the same regulatory requirements that emailed codes fail. Passkeys are not meant to have a vendor lock-in story. Credential exchange allows for credentials stored in consumer credential managers to be imported into another credential managers. The platforms have added infrastructure specifically to make this easier for users. The exceptions are when enterprises run their own passkey stores, or when the user explicitly picks a solution that doesn't allow export (like a physical Yubikey).