Receiving an email at your backup email address? Getting a text message? It’s whatever you have decided to set up in your account, the same as with a password.
I think the point with a passkey is that those very loose backup methods are required, since just knowing the password is not a thing. Everyone gets a new phone and is at risk of the previous one being unavailable. So passkeys mean that there's no way to deal with that reality, and also be truly secure.
I don't get it. I recover an account at ticketmaster by receiving an email. I recover an account at google by???
Receiving an email at your backup email address? Getting a text message? It’s whatever you have decided to set up in your account, the same as with a password.
I think the point with a passkey is that those very loose backup methods are required, since just knowing the password is not a thing. Everyone gets a new phone and is at risk of the previous one being unavailable. So passkeys mean that there's no way to deal with that reality, and also be truly secure.
1 reply →
What benefit does your 128-bits authentication schema gain when anybody can just clone a phone number?
Or do you demand that the user has an email with that 128-bits authn too, with a key on the same phone that was lost?