Comment by chrchr
5 days ago
I'm not an expert, but it's frustrating to read these threads about passkeys. The common objection I see here is "But if I lose my device I'm locked out!"
A lost passkey should be treated the same as a lost password.
Sites that implement passkeys need to have an account recovery mechanism. Granted, not every site does this correctly. Don't use passkeys on sites that don't have a recovery mechanism!
Secondly, the site you're authenticating to must allow you to have multiple passkeys. You either have a cloud-synced password manager so that all of your devices get the same passkey, or you have a passkey per device that you use to access the site. Again, not every site allows multiple passkeys. Don't use passkeys on sites that don't allow you to have multiple passkeys.
For a site implements both of these properties correctly, if you lose your device, you just connect to the site with your new device, perform whatever account recovery procedure (TOTP, email verification, phone verification, ...), create a new passkey, and, ideally, disable the passkey from your lost device.
The problem with "sites must allow you to have multiple passkeys" bullshit is that sites aggressively push you towards making that first passkey, but then hide the process for adding additional ones 6 layers deep in settings such that a typical user will never see it.
I literaly just had to unfuck my grandfathers webmail because of this garbage. "oh, I can only log into my email on my ipad now" and I immediately knew the shadowy cabal of evil over at the FIDO Alliance were to blame.
It is up to us technical users to make sure the other 90% of society don't fall for this shit. Tell them it's the mark of the beast, tell them that it's fascists seizing control of your identity, tell them whatever will make them run for the damn hills anytime they see "alternative ways to sign in".
TOTP was kinda like this too. The standard was fine, but actual implementations like Google Authenticator disallowed copying keys to another device, saying this is WAI and you're supposed to set up a separate TOTP per device. Absolutely user-hostile and took several years to fix.
Passkeys did better day 1 because they synced, probably just cause password managers are better now than back in the TOTP days. But for some reason the standard has a way for them to force you to use like a WEF-approved KYC passkey store.
I for the life of me cannot understand how these three things coexist about passkeys:
1. They should be locked down to a single device.
2. They should not be allowed to be copied from device to device.
3. Syncing between devices is perfectly acceptable.
2 replies →