Passkeys will come at a cost • Hacker News Board

Re: Passkeys will come at a cost

#411

Post by gbear605 » Fri, Jul 14, 2023, 10:26 PM UTC

thrashh wrote: post #401

tatersolid wrote: post #398

Earlier quoted context omitted.

And store that PDF where? Inside your Google drive which you can’t access within your t that PDF? On the same device you just lost? If you suggest “on a thumb drive kept offline” you’ve just recreated all the problems of physical FIDO keys without offering any phishing protection.

You could just store them in a separate password manager like BitWarden? Or even encrypted in a separate Dropbox account? Ultimately if you want to be able to recover your identity from anywhere in the world with absolutely nothing on you except cash (to buy a new device and service), you have to store this data somewhere. And you wouldn’t store this data in the same place that you’re trying to recover because that’s…

> you have to store this data somewhere

Hmm, what if you stored it in your head? Maybe we could call it a password?

Re: Passkeys will come at a cost

#412

Post by bombolo » Fri, Jul 14, 2023, 11:52 PM UTC

cbsmith wrote: post #404

bombolo wrote: post #288

Earlier quoted context omitted.

Except you'd have to invalidate a yubikey on countless websites.

I mean, if you're using a key to get in to countless physical things, then you have the same problem.

Do you have countless homes?

Re: Passkeys will come at a cost

#413

Post by asdff » Sat, Jul 15, 2023, 4:20 AM UTC

rcxdude wrote: post #104

asdff wrote: post #37

Passkeys make no sense. Its selling you something you already own, since a fingerprint or a retina scan makes a fine good two factor as well.

biometrics aren't passwords. They are only somewhat useful as authentication if you can verify that they are attached to the person you are authenticating, which generally only works in person.

True for passkeys no?

Re: Passkeys will come at a cost

#414

Post by asdff » Sat, Jul 15, 2023, 4:21 AM UTC

secabeen wrote: post #164

Nadya wrote: post #89

Earlier quoted context omitted.

What's your game plan for replacing your retina or fingerprints if compromised? Biodata is the least secure because it can't be easily changed and the technology already exists to compromise them.

Compromise isn't even the most common issue, it's your incapacity or death. Your relatives need some way to get into your accounts when you can't.

You can go, "here is the passkey to get into all my accounts" which would imply they don't lose the key and its not stolen. Or you can register their bio metrics into your whitelist and not have to deal with that.

Re: Passkeys will come at a cost

#415

Post by asdff » Sat, Jul 15, 2023, 4:22 AM UTC

microtonal wrote: post #60

asdff wrote: post #37

Passkeys make no sense. Its selling you something you already own, since a fingerprint or a retina scan makes a fine good two factor as well.

Someone gains access to a Passkey. You generate a new Passkey and replace the registered Passkey for the server. Someone gains access to your fingerprints or retina scan... Game over?