News for hackers. Stuff that matters.
Re:FIDO Alliance publishes new spec to let users move Passke... by lisper on Wednesday October 16, 2024 @09:59PM (#41865739)
> It's a problem for anything where you need to manually keep backups of key material.

Well, OK, but what is the alternative?

(Actually, you don't need to manually keep backups. You can have automatic backups, but those come with their own set of risks.)

Re:FIDO Alliance publishes new spec to let users move Passke... by bastawhiz on Thursday October 17, 2024 @10:30AM (#41870028)
I'd give a key to my bank that they could create signatures with if I asked for (and was authenticated with) that third parties could trust to bypass my passkey. I'd pay a fee for it, the bank holds liability for verifying my identity.

Banks aren't perfect but mine already has all my money and the deed to my house. I trust the safety of my bank more than I trust Google not to lock me out or all my hardware to be destroyed.

Re:FIDO Alliance publishes new spec to let users move Passke... by lisper on Thursday October 17, 2024 @11:25AM (#41870535)
OK, so your proposed alternative is to give a key to a trusted third party (TTP). But how do you authenticate to that TTP?