Google is trying to tie the Google account to a single device at the moment. Just yesterday, signing to a work account requires 2FA (enforced by the organization) and then click a number on Gmail app.
Tailscale doesn't want your password
131–140 of 316 posts
Re: Tailscale doesn't want your password
#132Earlier quoted context omitted.
It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…
I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. I use a password manager with a full backup of the vault, so the answer to most of the parent's question would be solved by getting the vault back from backup. Except: - passkeys are not yet supported by my password manager, so I'd have to wait for a while - can I move Safari's passkeys to my password managers afterwards,…
I don't know about Windows, but if you see the example your Mac is putting it in your keychain app, which is usely available on other devices that are connected to your Apple account. Also if you install a new macbook. Most likely also on your iphone. If you have an Android phone that will be a lot less smoot
Re: Tailscale doesn't want your password
#133There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…
It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…
How do I access my e-mail to reset my passkey when it's also protected by passkey?
Re: Tailscale doesn't want your password
#134Earlier quoted context omitted.
The email password reset feature is an overlooked part of modern security. It has become sort of like a master key for every service. Combined with password reuse it becomes really risky (but oh, so convenient).
This approach basically makes all the security provided by the passkeys void, as the whole system becomes no better than login-via-email-link or login-via-SMS-code scheme.
Every time an average user registers to a site with a passkey, they aren’t giving that their reused password that also provides access to their email (I believe that’s the main way email accounts get hacked).
If they registered to their email with a passkey, great.
Either way, passkeys seem to reduce the risk of the email being compromised.
Re: Tailscale doesn't want your password
#135I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question:
Why is this on top of HN?
Is it a novel invention by Tailscale?
Are they the first company who’ve done it?
Are they used by so many people (like GitHub) that this will have other implications?
Does the article go to technical details of their implementation that relates to the dev crowd?
Please, educate me, those who upvoted it.
Re: Tailscale doesn't want your password
#136[deleted]
Re: Tailscale doesn't want your password
#137why not skip this shit and go straight to biometric data? we all know it's coming.
Re: Tailscale doesn't want your password
#138I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…
People love Tailscale, and passkeys are relatively new, so a major authentication improvement for a well-loved service that is based on a new authentication mechanism not lots of companies support yet is … interesting. I think it’s as simple as that.
Re: Tailscale doesn't want your password
#139There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…
The passkey people won’t give you a straightforward answer because you won’t like the answer.
If the passkey is truly secure, you don’t get your key bak if you lose the passkey. If you make a copy of the passkey, the passkey purists will say it’s not “secure”.
If you lose your phone and delete your existing login cookies you don’t get access again. If email or sms is the recovery method, you might not be able to login on a new device or IP without your phone. But if email was the recovery method it’s just the same as sms 2FA which is reasonably secure and fail safe for the average person because there is a trusted third party in the loop…