Google announces passwordless by default: Make the switch to passkeys

Re:Google announces passwordless by default: Make the switch... by the_snooze on Tuesday October 10, 2023 @01:23PM (#37834866)

Passkeys aren't inherently un-backup-able. I do agree though that the most common forms of it (e.g., Android/iOS/Windows secure enclave passkeys) need better ways of recovery and remediation.

That said, what you describe is easily doable in other forms. For hardware tokens, you can have a spare Yubikey that's authorized on your accounts and keep that in a fire safe with its unlock PIN. For something like 1Password, you can print out a recovery kit [1] with the secret key and unlock password.

[1] https://support.1password.com/emergency-kit/

[ Parent | on HN ]

Re:Google announces passwordless by default: Make the switch... by secabeen on Tuesday October 10, 2023 @02:01PM (#37835338)

> Passkeys aren't inherently un-backup-able

Agreed, I'm just not willing to endorse their use until there are robust recovery and remediation processes.

> For something like 1Password, you can print out a recovery kit [1] with the secret key and unlock password.

Yeah, this is what I want Google/Appleto provide as it is robust to both user incapacity and provider refusal-of-service.

[ Parent | on HN ]

Re:Google announces passwordless by default: Make the switch... by goalieca on Tuesday October 10, 2023 @11:08PM (#37840449)

> Agreed, I'm just not willing to endorse their use until there are robust recovery and remediation processes

They seem ripe for corporate use where ransomware and phishing are common threats and IT can manage account resets by walking over to their desk.

[ Parent | on HN ]