Toward a Passwordless Future
privacyguides.org
Toward a Passwordless Future
1–10 of 70 posts
Re: Toward a Passwordless Future
#2So... what happens with passkeys if you lose/break/someone_steals your phone?
I'm talking about normal users, without backups.
Re: Toward a Passwordless Future
#3So... what happens with passkeys if you lose/break/someone_steals your phone? I'm talking about normal users, without backups.
The same thing that happens if you enroll in 2FA and lose your 2FA cred: you go into a complicated account recovery process.
For this reason, at the huge providers, when you enable 2FA (or Passkeys) you usually have to set up a recovery buddy account or something like it.
Re: Toward a Passwordless Future
#4So... what happens with passkeys if you lose/break/someone_steals your phone? I'm talking about normal users, without backups.
All of the major implementations sync across all of your devices and use recovery codes as part of the setup process. Apple’s implementation is designed to cover loss of all devices, and I’d assume the others are similar:
https://support.apple.com/guide/security/escrow-security-for...
The key thing to understand is that passkeys are not intended to be as secure as hardware tokens but to be more secure than traditional passwords with phishing-friendly MFA. That allows them to offer better recovery options but might not be good enough if you are the target of a serious actor.
Re: Toward a Passwordless Future
#5So... what happens with passkeys if you lose/break/someone_steals your phone? I'm talking about normal users, without backups.
The same thing that happens if you enroll in 2FA and lose your 2FA cred: you go into a complicated account recovery process. For this reason, at the huge providers, when you enable 2FA (or Passkeys) you usually have to set up a recovery buddy account or something like it.
But if that "buddy account" is 'passworded' by the same passkey device?
Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes.
I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.
Re: Toward a Passwordless Future
#6So... what happens with passkeys if you lose/break/someone_steals your phone? I'm talking about normal users, without backups.
All of the major implementations sync across all of your devices and use recovery codes as part of the setup process. Apple’s implementation is designed to cover loss of all devices, and I’d assume the others are similar: https://support.apple.com/guide/security/escrow-security-for... The key thing to understand is that passkeys are not intended to be as secure as hardware tokens but to be more secure than traditiona…
What if the provider of the major implementation decides to shut you out of your account?
Re: Toward a Passwordless Future
#7Earlier quoted context omitted.
The same thing that happens if you enroll in 2FA and lose your 2FA cred: you go into a complicated account recovery process. For this reason, at the huge providers, when you enable 2FA (or Passkeys) you usually have to set up a recovery buddy account or something like it.
But if that "buddy account" is 'passworded' by the same passkey device? Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes. I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.
Until the passkey workflow goes sideways for "tech" people I don't think the risks will be acknowledged (if then even).
Those of us who don't want the let Google, Apple, or Microsoft manage our passkeys (i.e. pledging our fealty to our lords) will be seen as fringe lunatics.
I'll keep my workflow of always visiting sites by typing the URL myself, using a password manager, and TOTP 2FA w/ the secrets saved offline on paper. At least until I'm not allowed to do that anymore.
Re: Toward a Passwordless Future
#8Earlier quoted context omitted.
But if that "buddy account" is 'passworded' by the same passkey device? Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes. I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.
Until the passkey workflow goes sideways for "tech" people I don't think the risks will be acknowledged (if then even). Those of us who don't want the let Google, Apple, or Microsoft manage our passkeys (i.e. pledging our fealty to our lords) will be seen as fringe lunatics. I'll keep my workflow of always visiting sites by typing the URL myself, using a password manager, and TOTP 2FA w/ the secrets saved offline on…
Luckily Bitwarden supports passkeys. And you can self host it. And even vaultwarden/bitwarden-rs supports passkeys
Re: Toward a Passwordless Future
#9So... what happens with passkeys if you lose/break/someone_steals your phone? I'm talking about normal users, without backups.
Normal users have backups in the cloud. They also enable biometric so a stolen phone is no use. Even if stolen in a mugging.
Re: Toward a Passwordless Future
#10I really don't want to use Passkeys until they can be stored in my password manager of choice on Linux, Android and Windows.