Re:Passkeys: The Beginning of the End of the Password
by lxgr on Wednesday May 03, 2023 @07:31PM
(#35809257)
Apple won’t even let you set up Passkeys without online backups/syncing enabled. Not sure if Android does.
Re:Passkeys: The Beginning of the End of the Password
by dwaite on Wednesday May 03, 2023 @09:38PM
(#35810242)
The upcoming W3C Web Authentication Level 3 defines a "backup capable" authenticator, which means that it goes beyond a single piece of hardware. Indicating "backups enabled" means that the user has a recovery process, such as if they store the passkeys in their iPhone and then lose/upgrade the model - they can just sign into iCloud on the new device.
Not all authenticators are going to have backups enabled (even ones which are backup capable), so these are really meant as hints so that a website (a la Relying Party in the spec) can guide the user to a proper experience. For instance, if you use a hardware security key fob, they may recommend you keep your password and SMS enabled as options, so you can get in even if you lose it.
Re:Passkeys: The Beginning of the End of the Password
by JohnFen on Thursday May 04, 2023 @12:06PM
(#35817649)
> For instance, if you use a hardware security key fob, they may recommend you keep your password and SMS enabled as options, so you can get in even if you lose it.
But if you have this and the old authentication methods, doesn't that greatly reduce the security gains of this? I mean, the old methods still exist, so what you've done is increase the attack surface.
But all of that has to be set up in advance, right? What happens if I really only have a single passkey, associated with my phone, and then lose the phone?