91–100 of 154 posts
Earlier quoted context omitted.
If I lose the keys to my house, I break the window, enter the house and change the lock. If I use my digital keys, It's over.
How many times have lost your house keys and needed to break the window and change the lock?
Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!
I think that's best handled through some iteration: We don't need to flip a switch and make the whole world change to this system overnight. Instead, we could roll it out in managed environments, like companies and schools with IT departments.
I suspect that, for consumers, something like a (the horror!) government agency could handle this. Or a bank. Or your ISP. Or your phone service provider. Or the AAA (who handles passport and license renewals in the US.)
Earlier quoted context omitted.
I guess it's tricky because at work, a central secret store with permissions and some kind of audit trail is a good idea. At home some cloud backup / syncing should be done, but I don't think that replaces local backups and everything. What's the issue here, people can't export backups of the passkeys?
> What's the issue here, people can't export backups of the passkeys? Quite the opposite. You can, and are always advised to, have a second key as backup that you can keep in a secure location. So in the same way as you don't lose your home if you lose your home's keys, you don't lose your digital access if you have a backup passkey. There is a slight difference between the two scenarios as in the case of your home,…
I can't wait for companies to use secure passkeys and still force me to use SMS 2FA with no option to disable it.
Earlier quoted context omitted.
Wait - the way this works is you have a backup key, if you lose your primary you replace it using your backup. NB this is only needed when you move to a new device with a new secure enclave too, so at no point is this pizza situation likely.
Yeah, but you need to add all those secrets to your backup key. So you need to get it out every time you register somewhere.
> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?
Because passkey is owned by you (as in - whichever software vault you're using) and not Facebook. It's no different than stored random 32 character passwords in a password manager... it's pretty much the same really, just that you don't have to copy/paste it in a form.
Earlier quoted context omitted.
The device is not mandated to be a phone. A hardware passkey is also an option. You carry the keys to your home everywhere, don’t you? And you take good care of them? Why would carrying a webauthn-compliant hardware key be any different?
i have a bunch of copies of my house key, including one at a neighbors house and one in a realtor-style lockbox in my back yard. If I somehow lose all of them, I can still call a locksmith who can re-key my locks for maybe $300ish. There is no conceivable circumstance in which losing my key(s), no matter how badly I mess up, even if I only had one copy and threw it in the ocean in a fit of rage, will permanently deny…
FWIW be sure to assign proper expectations of security to those lockboxes, i.e. very very low.
I make a hobby of defeating them at friends' houses. Takes a few minutes.
The last time I sold a house, I brought the lockbox to the closing to hand to my real estate agent. He was perplexed.
Earlier quoted context omitted.
> You carry the keys to your home everywhere, don’t you? Perhaps most people do. There's also quite a few people that lose those keys - perhaps through neglect or being stupid, perhaps through an accident or getting mugged. Note that of those unfortunate people that lose their keys, very, very few of them lose their house and everything in it as well - there's many paths to normally quick recovery that would need to…
I guess it's tricky because at work, a central secret store with permissions and some kind of audit trail is a good idea. At home some cloud backup / syncing should be done, but I don't think that replaces local backups and everything. What's the issue here, people can't export backups of the passkeys?
I can, and do, backup and safeguard my KeePass database in ways many and various. I have a fairly robust system to backup "traditional stuff" - including sync to my local NAS, a monthly off-site exchange of external drives with my best friend, and a cloud sync.
I have NO clue how to backup my whatever this is keystore or database or whatever, in a way that I'll feel confident I can seamlessly resume my life. It all seems to be embedded in some cloudy or device-internal ethereal opaque invisible places that make my life super easy when they work and when I do predictable things, and make my life devastating when they don't work or I do unpredictable things. I'm literally and genuinely and actually scared of these changes - not for when they work well, which is apparently magical; but when they don't work well or I fall through system cracks through some unknown change or issue.
Earlier quoted context omitted.
happily for you, you have the problem AND the solution! next time, (besides using gloves for once) drop a blob of shellac on a shallow container with flexible sides (silicone or any flimsy bottle cap). After a few hours, take off gloves and thumbprint for several minutes with very light pressure on the blob of shellac. after another few hours, tie some nylon ties to the side of the container and tighten every now and…
https://www.livescience.com/62393-dead-fingerprint-unlock-ph...
[0]: https://www.cnet.com/tech/mobile/galaxy-s10-has-ultrasonic-f...
Name one system that accepts passkeys and allows you to setup two of them. as is the recommended best practice everywhere. even OTP tokens generators goes to great lengths to give a false sense o security that their seed is unique simply by hiding it from the user UI. Google authenticator will happily save the seed and seed tokens in their cloud and allow you to restore. all while still hiding it from the user. if yo…