61–70 of 70 posts
Earlier quoted context omitted.
Just use a password manager that allows you to have a local copy of everything (e.g. KeePass) and just back it up as any other file
That could work, assuming your usual file backup methods are secure enough and it doesn't create a circular dependency.
I really don't want to use Passkeys until they can be stored in my password manager of choice on Linux, Android and Windows.
I was enthused when it first got added to KeypassXC but after a few attempts I couldn't get it working and haven't bothered since. Something fundamentally isn't quite working here and I am not a big fan of the workflow for them its entirely out of my hands and I am not a fan of that.
Earlier quoted context omitted.
That depends on whether you need to have an active account to use your existing devices. For example, an Apple user would need to migrate before things fall out of sync but they have a full copy on every device. The fallback path here is what you’d do with any other MFA loss. It’s not a federated login system so you’d be looking at some kind of account recovery process for each of the sites where you used your passke…
> The fallback path here is what you'd do with any other MFA loss. Which, in many cases, is avoid MFA because it's less secure. Yes, less secure because availability is part of security. And I don't have a better plan to store all those recovery codes than to store all those passwords. So the attacker can still get in with the same effort, but I have to keep getting my phone. No thank you.
This is too often forgotten. Availability is a fundamental part of security and must be part of every threat model.
And your threat model needs to be matched with what it is being protected. One size does not fit all.
For example to log in to my brokerage account, I may be ok with a solution where I might lock myself out and have to go to a physical branch to restore access. Because while that would be a pain, it's better than having my life savings stolen.
But to log in to, say, facebook? Availability and convenience is #1 above all, it's just cat videos and other extremely low value stuff so it's not worth any inconvenience.
Earlier quoted context omitted.
That depends on whether you need to have an active account to use your existing devices. For example, an Apple user would need to migrate before things fall out of sync but they have a full copy on every device. The fallback path here is what you’d do with any other MFA loss. It’s not a federated login system so you’d be looking at some kind of account recovery process for each of the sites where you used your passke…
This is incorrect, there is no fallback once they have shut you out. The correct answer is to not use a passkey that's managed by the device ecosystem.
Earlier quoted context omitted.
It’s easier to print things and you have clear instructions telling you why it’s important. The key here is thinking about relative risk: many people get compromised by reusing passwords or being phished every day compared to the number of people who simultaneously lose all of their devices and recovery codes.
It's not easier to print things. Only about 60% of the population has a printer and that number is going down, not up.
Earlier quoted context omitted.
Until you lose the device. Or you're given security codes and those are again, leakable and guessable. No normal user is going to accept their phone being stolen and losing access to their bank account. It's bitcoin as unregulated fiat levels of wishful thinking
Registering your phone as a passkey through Apple or Google will cloud-sync the key. This isn’t great for isolation, but is pretty good for availability. Using something like KeepassXC puts you in charge of your own backups. I’m sure we can all find people for whom one or the other would be preferable.
Isn't it lovely that the big players can do that...
and when Keepass or others want to do it, they are threatened in no uncertain terms with de-attestation? Members of the FIDO Consortium threatening KeePassXC and other open source tools with blocking for sharing "roaming keys", meanwhile "Oh, Apple wants to share keys via AirDrop? No problem", which is one of the concerns, that it's yet another "push users to Apple and Google's tool of choice".
> https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
"Users should be prevented from copying or sharing a private key".
Earlier quoted context omitted.
But if that "buddy account" is 'passworded' by the same passkey device? Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes. I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.
Getting a SIM card is too easy, many millions have been lost to sim-jacking.
Some countries have problems with people and IDs, like US, so that's a different story.
Earlier quoted context omitted.
That and the hypothetical ability to use different private keys per device, which could be canceled in case of loss or theft, seems legitimately useful. Not interested unless and until there's a standalone, standardized, open-source, cold-backup'ed way to use passkeys though.
Try out KeepassXC :)
Earlier quoted context omitted.
Passwords are still leakable, guessable, and can be phished. Passkeys are “second-factor-only”: your device responds to a challenge and acts in a similar capacity to a yubikey. The private keys contain much more entropy than a password, never leave the device, and the challenges and responses are both signed with site-specific keys so they can’t be phished. So from a security perspective, a lot is gained. From a user…
"Leakable" isn't a purely negative property. It's the same thing you can use to provide access to a trusted spouse, and ensures a trivial solution to the "lost device" problem when traveling.