News for hackers. Stuff that matters.

A comment on FIDO Alliance publishes new spec to let users move Passkeys across providers. Parent comment

Re:FIDO Alliance publishes new spec to let users move Passke... by ForHackernews on Thursday October 17, 2024 @05:22AM (#41867819)
> Sites still ultimately have to have a recovery process when someone does lose access.

Do they? Is that legally mandated somewhere, or can they just say "You're stuffed, make a new account if you want"?

[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by jesseendahl on Thursday October 17, 2024 @08:51AM (#41869205)
Account recovery flows are generally entirely unaffected by the move from password to passkey.

It’s just your login credential.

If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.

[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by jakub_g on Thursday October 17, 2024 @12:39PM (#41871234)
This exactly where my distinction about "what the passkey actually is" is important: if it's only a password, then I assume I can do the recovery. Whereas if it's 2FA, I assume I can't.
[ Parent | on HN ]