News for hackers. Stuff that matters.

A comment on Microsoft Confirms Password Deletion for 1B Users. Parent comment

Re:Microsoft Confirms Password Deletion for 1B Users by Dylan16807 on Tuesday December 17, 2024 @02:45PM (#42444549)
> I'm saying that the world which passkey advocates want is a world where if, for any reason, you can't log in with your passkey (due to a lost/broken device, a software bug, whatever), you'll be locked out of your account.

And a world where people only use passwords has the same problem if you can't log in with your password.

Moving from one single point of failure to another isn't great, but it's not a downgrade.

(And just like it's possible to back up a password, it's possible to back up a passkey. And I know passwords can be memorized, but in practice it's bad passwords that get memorized.)

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by mort96 on Tuesday December 17, 2024 @04:07PM (#42445316)
How do I back up my passkeys? How do I get them out of iOS and into some file I control and can sync?
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by Dylan16807 on Tuesday December 17, 2024 @06:39PM (#42446647)
If you're using the iOS built-in storage then it backs up to icloud and syncs to your other iOS devices.

If you specifically want a file you can control you need to use other passkey software, like bitwarden. Which you already mentioned? Huh.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by mort96 on Wednesday December 18, 2024 @01:43AM (#42448567)
So I can't back them up in a way I control, so that I can transfer them to non-Apple devices? That's what I thought.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by Dylan16807 on Wednesday December 18, 2024 @02:14AM (#42448684)
You are describing a problem with a single implementation, not passkeys in general.

It's a really ineffective gotcha. And extra transparent because you talked about bitwarden first.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by mort96 on Wednesday December 18, 2024 @02:28AM (#42448714)
I use Bitwarden for critical passkeys. Most people do not. Passkeys, as currently implemented, for the vast majority of people, do not allow for effective back-ups in ways the user controls. You can't back up the keys from your iCloud and then use them on your friend's Windows PC to access something when you lost your iPhone. You can do that with passwords.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by Dylan16807 on Wednesday December 18, 2024 @02:44AM (#42448760)
https://fidoalliance.org/fido-alliance-publishes-new-specifi...

I'm not super worried.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by mort96 on Wednesday December 18, 2024 @02:59AM (#42448819)
I am. I'm not convinced that this will allow me to back up passkeys in any way. I wouldn't be surprised if Apple were to allow you to transfer passkeys out in such a way that they don't work on the original device anymore, which would make this standard irrelevant for what we're talking about.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by Dylan16807 on Wednesday December 18, 2024 @04:34AM (#42449175)
That would be weird to do when they already encourage sync. But if they do, the worst case would be transfer out, back up, transfer in again.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by vel0city on Wednesday December 18, 2024 @11:18AM (#42451811)
> You can't back up the keys from your iCloud and then use them on your friend's Windows PC to access something when you lost your iPhone.

Just enroll a second device like a hardware token. Then plug your hardware token into your friend's computer and you can log in to sites on your friend's PC without having to copy over and unlock your entire password safe.

[ Parent | on HN ]