56 ms·

Yes, it’s like a key. :) Though realistically I use a passkey for services I care about and a password manager for the rest.

eikenberry 8d ago
Keys can be copied very easily. It’s one of their primary features. Can you easily copy your USB key?
- jazzyjackson 8d ago
  Yubikeys are Secure Enclaves designed to not be copyable
  - eikenberry 8d ago
    Right. That's the flaw I was pointing out.
- krupan 8d ago
  Physical keys can easily be copied, and physical locks can easily be picked. That might be fine for your house or storage unit, but for your bank account or your car (newer cars no longer have simple physical keys/locks), we've moved beyond that tech.
  - mrguyorama 8d ago
    That any and all physical security measures can be defeated is a feature, not a bug. Almost no human beings actually need that level of security, and the tradeoffs are absolutely not worth it for those of us without Mossad as a threat. How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.
    - krupan 8d ago
      No web service is like that. They all offer recovery options. We aren't talking about Bitcoin here.
      - EvanAnderson 8d ago
        The trend of companies becoming easier to contact and customer service becoming better is well-documented.
      - Telaneo 7d ago
        Tell that to the people who have lost access to their Google account.
        krupan 6d ago
        Now we aren't talking about a security problem, we're talking about who really owns what. Google can lock you out of your account no matter what kind of authentication they use for that account
        Telaneo 6d ago
        It's a lot easier to be locked out with a passkey than without one.
        krupan 6d ago
        No it's not. Google flips a bit in their database and no matter what kind of authentication you set up with them, you get denied
        Telaneo 6d ago
        This does not reflect my own lived experience. But if true, that means that Google can choose to not provide you a recovery service, which is functionally the same as them not having it.
- apexalpha 7d ago
  You can 'copy' it by registering a new one to the service.

eikenberry 8d ago

Keys can be copied very easily. It’s one of their primary features. Can you easily copy your USB key?

jazzyjackson 8d ago
Yubikeys are Secure Enclaves designed to not be copyable
- eikenberry 8d ago
  Right. That's the flaw I was pointing out.
krupan 8d ago
Physical keys can easily be copied, and physical locks can easily be picked. That might be fine for your house or storage unit, but for your bank account or your car (newer cars no longer have simple physical keys/locks), we've moved beyond that tech.
- mrguyorama 8d ago
  That any and all physical security measures can be defeated is a feature, not a bug. Almost no human beings actually need that level of security, and the tradeoffs are absolutely not worth it for those of us without Mossad as a threat. How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.
  - krupan 8d ago
    No web service is like that. They all offer recovery options. We aren't talking about Bitcoin here.
    - EvanAnderson 8d ago
      The trend of companies becoming easier to contact and customer service becoming better is well-documented.
    - Telaneo 7d ago
      Tell that to the people who have lost access to their Google account.
      - krupan 6d ago
        Now we aren't talking about a security problem, we're talking about who really owns what. Google can lock you out of your account no matter what kind of authentication they use for that account
        Telaneo 6d ago
        It's a lot easier to be locked out with a passkey than without one.
        krupan 6d ago
        No it's not. Google flips a bit in their database and no matter what kind of authentication you set up with them, you get denied
        Telaneo 6d ago
        This does not reflect my own lived experience. But if true, that means that Google can choose to not provide you a recovery service, which is functionally the same as them not having it.
apexalpha 7d ago
You can 'copy' it by registering a new one to the service.