News for hackers. Stuff that matters.

A comment on FIDO Alliance publishes new spec to let users move Passkeys across providers. Parent comment

Re:FIDO Alliance publishes new spec to let users move Passke... by rootusrootus on Wednesday October 16, 2024 @05:05PM (#41863858)
If the passkey is all you have, then you're doomed (at least to the extent of whatever alternative recovery procedures the vendor is making available to you). That's why it's pretty universal to provide backup codes to put in your safe when setting up a passkey.
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by create-username on Wednesday October 16, 2024 @05:27PM (#41864020)
you should have passkeys on at least two or three devices
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by EvanAnderson on Wednesday October 16, 2024 @08:51PM (#41865385)
Having one more thing to remember to do when I create a new account seems like the kind of tedious make-work computers should be automating.
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by rootusrootus on Wednesday October 16, 2024 @09:01PM (#41865431)
I agree. The better answer from my view is to handle passkeys like passwords and manage them the same way.
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by hedora on Wednesday October 16, 2024 @11:59PM (#41866292)
How do you keep those devices synced? I have over 500 accounts in my password manager. Do I need to manually set up 500 * 3 devices?
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by klausa on Thursday October 17, 2024 @02:05AM (#41866851)
You use your password manager to sync them.
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by create-username on Friday October 18, 2024 @04:52PM (#41883393)
I sync them manually, like a medieval peasant
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by lxgr on Thursday October 17, 2024 @03:23AM (#41867227)
Unfortunately that pattern negates many benefits of WebAuthN: That recovery code is phishable, can be captured by malware on the client or server etc.
[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by jesseendahl on Thursday October 17, 2024 @08:56AM (#41869238)
Account recovery flows are generally entirely unaffected by the move from password to passkey.

It’s just your login credential.

If you lose either a password or a passkey, you do the same thing: set a new one via email recovery.

[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by CatWChainsaw on Monday October 21, 2024 @05:17PM (#41908599)
A backup code is a password made of numbers.
[ Parent | on HN ]