News for hackers. Stuff that matters.
Re:Microsoft Confirms Password Deletion for 1B Users by 0cf8612b2e1e on Wednesday December 18, 2024 @12:05PM (#42452360)
And the scenario where you lose all devices? Just don’t let that happen?
Re:Microsoft Confirms Password Deletion for 1B Users by vel0city on Wednesday December 18, 2024 @12:21PM (#42452551)
I mean, yeah?

If the giant meteor comes crashing down to destroy everything around me, I don't think I'll be that concerned about getting locked out of a video streaming site.

Even if I have a house fire. Small chance it'll actually destroy all my devices and paper recovery codes. And the odds of having that house fire is also pretty low.

If a tornado destroys my house, chances are my hardware tokens will survive. More of a question of where they ended up. A tornado destroyed my brother's house, his iPad ended up just fine.

I don't really live in an area where landslides are possible. If I did I'd probably want to plan around that with the passkeys. But that's true for a number of things at that point though.

What if every device hosting a password safe breaks?

Re:Microsoft Confirms Password Deletion for 1B Users by 0cf8612b2e1e on Wednesday December 18, 2024 @01:52PM (#42453553)
Most people do not have a surplus of devices. They might only have a single phone which carries their life. A phone which at any moment could be lost, stolen, or destroyed.

A password safe, I can trivially backup however I wish. The cloud, a USB I keep at mom’s house, print it out, whatever (in fact, I do maintain encrypted offsite backups in a couple of locations).

Re:Microsoft Confirms Password Deletion for 1B Users by vel0city on Wednesday December 18, 2024 @02:05PM (#42453683)
> A password safe, I can trivially backup however I wish

Boy do I have good news for you then. Passkeys can often be stored in many available password safes. Bitwarden, KeepassXC, LastPass, 1Password, Dashlane, and more all support passkeys. Make one on whatever device, one in your password safe, and you'll have redundancy.

And I'm not talking about people needing to carry two $1,000 phones or a $1,000 phone and a $1,000 laptop. You could have your second key be a small, cheap (<$40), durable authenticator. Another thing on a keychain, another card in a wallet. Really that big of a deal?

And if that's truly impossible for you, then sure I'll agree passkeys might not be for you. I agree, some people like those who are homeless have a hard time keeping any material goods safe. I'm not arguing every account for every person needs to be only passkeys. But people here are acting like it's something impossible for nearly anyone to use safely. And I don't think that's based in reality. I think a lot of people could use them safely if they wanted to, but there's a massive amount of FUD about them.

Re:Microsoft Confirms Password Deletion for 1B Users by jesseendahl on Thursday December 19, 2024 @03:47AM (#42459617)
I don't know how other providers deal with recovery, but if you use iCloud Keychain for storing/syncing your passkeys, Apple has a very impressive amount of recovery options, including an option for recovery even if you lose 100% of your devices.

See the section titled "Recovery security" in this support article:

https://support.apple.com/en-us/102195