Technologically there's nothing really bad about them (imagine a managed version of ssh keypairs). Technically they could even be backed by physical devices like Yubikeys and never touch the cloud.
My worry is the actual implementation, where platforms might lock you into their cloud as the sole provider simply by not implementing interoperability...
How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?
Recovery code system? Like 2FA today, generate a special bootstrap key you can print and save.
This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)
Re:Tailscale doesn't want your password
by recursive_loops on Thursday June 08, 2023 @01:29PM
(#36245522)
> generate a special bootstrap key you can print and save
So ... a password?
Also in this scenario you've been robbed. It's quite possible that either they took your printed out passkey also since it was in your wallet, or you're not at home where you can get the pass key from your file cabinet or safe.
Not really. A password is meant to be memorized and reproduced correctly regularlt, whereas a recovery key doesn't need that and can be very long and complicated since it is rarely used.
Re:Tailscale doesn't want your password
by hotpotamus on Thursday June 08, 2023 @12:22AM
(#36237161)
Probably easier to start a new life at that point.
Can we please stop the bandwagon for a moment and inquire about the downsides of Passkey?