461–470 of 813 posts
Earlier quoted context omitted.
You can choose either if your password manager supporte Passkeys
Of course. I was just pointing out that their claim about the lack of portability across devices was untrue.
Earlier quoted context omitted.
> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…
Apple's keychain or google password manager - can hold 2000 passkeys easily.
Earlier quoted context omitted.
> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.
Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication. If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.
Earlier quoted context omitted.
Considering Google's track record of locking people out of their accounts it'd be very risky to trust them with your password manager.
This is very far from the top of the list of risks I should be concerned about. Basing your security decisions on the frequency with which you hear about something bad happening in the news is not a wise strategy. You have to consider that the user base of Google accounts is in the billions.
Basing your security decisions on "it'll never happen to me" because there are billions of other users who will get burnt first is not a wise strategy either.
Why take the chance when there are so many other alternatives that let you own your vault or at least companies that still have some semblance of a support team.
Losing a decade of my Google Maps Timeline data even with backups enabled made me realise I may not be lucky enough to win the lottery but I am lucky enough for Google to pick little old me, hidden in the billions, to lose my data.
With physical U2F key, I could explain to my 78 year-old-parents "this is a physical key needed to access your account. Think of it like the front door key to your house. Don't lose it or lend it to anyone. We should have a couple of backup keys too." And they got completely understood and added it to all of their accounts. This was not hard. People assumed consumers were too stupid to do this without even giving the…
I never found a comfortable way to ensure all of my accounts had more than one U2F key associated with them. I always wished there was a way to have 2 physical U2F keys, one on me, and by adding one to an account, both would work. As is, I had to either: - Keep both on me, and add both - I am at risk of losing both at the same time - Keep one one me, one in a safe - I have to keep track of which device I've added to…
I ask because I'm curious about others' practices and desires here, not with any promise of a better solution!
Earlier quoted context omitted.
> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…
> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…
The biggest point of confusion in my opinion comes from Windows especially having lacked a way (and kind of still does) to save the private key of a passkey to your password manager, defaulting to saving it to Windows Hello, which saves the private key to your PC's TPM. In this scenario you can no longer easily copy the private key to other devices, and if you lose that Windows PC, you also lose the private key and the whole passkey as a result.
It seems to me like those who like passkeys/consider them simple are those who entrust all their credentials to proprietary cloud software vendors that sync them to all their devices. Those of us who are not comfortable with that and want to keep our credentials offline and sync/backup them ourselves have questions about how the registration/backup/sharing flows work exactly. I see this as part of a trend together wi…
I do love the cloud version of passkeys, but I also have a backup YubiKey. I could do two backup YubiKeys, drop the cloud, and keep one YubiKey in a safe deposit box and one elsewhere, but I haven't had much reason to yet. A passkey doesn't give up anything compared to a password, and is in fact much much easier to handle, IMHO. I have kept all of my private SSH keys in secure hardware for a decade, so perhaps I'm mo…
How does this work, exactly? Does you cloud password/key manager allow syncing to the YubiKey?
Or do you register a second passkey that you store on the YubiKey whenever you create a passkey?
If it is the latter, do all services that allow passkey authentication also allow registering multiple passkeys? How many?
> could do two backup YubiKeys [...] keep one YubiKey in a safe deposit box
If you register a new passkey on the primary, do you then have to take the backup YubiKey out of the safe deposit box to put it on it as well?
I haven't seen this kind of question answered when sites prompt me to use passkeys instead of passwords.
Earlier quoted context omitted.
This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…
So to login using a public PC, you need either USB access (and carry around your password manager) or you need to install the password manager on the PC to log into a website?
Earlier quoted context omitted.
No technology in the world can protect you against every threat model and unlikely scenario. What if the robber hits you in the head and you get brain damage and forget your password?
That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.
It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…
And Windows, you need Bluetooth enabled on both devices, on Linux you need Chrome (and presumably bluetooth enabled). It makes you scan a QR code.