Comment by EugenioPerea
5 days ago
If you own only one device—a mobile phone, like the majority of people in the world—and you lose it, how do you get back into your passkey-protected email account?
5 days ago
If you own only one device—a mobile phone, like the majority of people in the world—and you lose it, how do you get back into your passkey-protected email account?
This is site-specific, but typically by using the same mechanisms used to reset forgotten passwords.
Also, sites can and often do support multiple passkeys, which opens up the possibility of allowing for reliable account recovery using one or more backup devices (one or more YubiKeys, for instance) that is still siginificantly more secure than reset flows using SMS or email.
I think the point is I can make a physical copy of my backup email and password. How do I print a passkey for safekeeping?
In other words, my email can be signed in from anywhere on purpose. It's a feature. The chances of me forgetting my password is zero, because I can back it up 7 way to Sunday.
A passkey seems to miss these basic accessibility issues. For a random website, that's fine, but for the service all of websites use to auth me, access is more important than locking it down to one device.
Backup codes, sms backup, trusted user backup. Most of these are quite insecure but better than loosing access to your digital life.
How would you get back into your email account if you lost your password or password manager? It is the exact same situation.
Most Passkey implementations by default are syncable/copyable/backupable. The iOS default is iCloud Password Manager and keys get backed up to iCloud and restored on device restore when replacing a phone (just like the rest of the users passwords they choose to store). Android has similar defaults with the Chrome Password Manager.