Tailscale doesn't want your password

Apparently Google's implementation stores an encrypted backup of the passkeys in your Google account [1]:

> A single passkey identifies a particular user account on some online service. A user has different passkeys for different services. The user's operating systems, or software similar to today's password managers, provide user-friendly management of passkeys. From the user's point of view, using passkeys is very similar to using saved passwords, but with significantly better security.

[...]

> In some cases, for example, when the older device was lost or damaged, users may need to recover the end-to-end encryption keys from a secure online backup.

> To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys. Note, that restoring passkeys on a new device requires both being signed in to the Google Account and an existing device's screen lock.

So, if you use Google to store passwords or passkeys, it would be a good idea to save backup codes for your Google account somewhere safe. (Like you should do anyway.)

[1] https://security.googleblog.com/2022/10/SecurityofPasskeysin...

Passwords are outdated in the same way key locks ok doors are outdated and all they did is have someone else manage federated authentication.

I am so exhausted at screaming into the void over this topic. You all do whatever crap you want just know that whatever you do, if it isn't at least 2FA it is as shitty as passwords. New and secure just means threar actors haven't adopted to it yet. You know the nice thing about old shitty security? There is decades of work and lessons learned on how to make it work nice.

Keep your silverbulletd and reinvented wheels and give me knowledge based factor (password,passphrase,pattern,etc...) and a completley separate NGC like FIDO2 and credential recovery options that don't involve email or yet another set of credentials. Now, that hard security implementation will actually keep me secure but these lazy bullshit security anti-patterns force me to depend on some bullshit 3rd party vendor, compromise on my privacy and still have me be one step away from total pwnage.

All tailscale has convinced me is that they think passing the buck to someone else or getting in on a hype is in the best interest of their users as opposed to investing in layered and reliable security.

I'm not sure if it's true anymore, but Twitter for years only supported a single WebAuthn token.

So, how do you reset your password when you forget it? Well, it depends.

Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there.

Some apps/sites try to do something cleverer, e.g. requiring additional factors to reset (MFA), or appointing a "trusted contact" user who can confirm your password reset, or asking "security questions" that only you know the answer to. Those apps/sites would put you through the same process to reset your passkey.

"How do I reset my password when I forget it" is an infamous balancing act between user friendliness and strict security. The "reset my passkey" problem is exactly as hard, no easier and no harder, as the "reset my password" problem.

(Of course, it's possible to have a site that has no way to reset your password, and just assumes that you'll never forget your password. Similarly, those sites could have no way to reset your passkey. In that case, the problem is as you say: there'd be no way to recover your keys if you lost access to them.)