News for hackers. Stuff that matters.
Re:Microsoft Confirms Password Deletion for 1B Users by jesseendahl on Thursday December 19, 2024 @04:16AM (#42459774)
>and people will end up with passkeys that aren't backed up anywhere and get locked out of their accounts.

I don't know why this is such a common misconception about passkeys.

Account recovery flows are generally entirely unaffected by moving from passwords to passkeys. If a user forgets their password or passkey, they generally go through an email recovery flow and generate a new one.

Re:Microsoft Confirms Password Deletion for 1B Users by Wowfunhappy on Thursday December 19, 2024 @12:46PM (#42463920)
Why do we even have passkeys at this point? Just store a cookie and use email verification for adding new devices.

...this is sort of a rhetorical question, but also maybe not? Slack does it, as do some other services I can't think of off the top of my head. I feel like a lot of normal people who don't use password managers basically always use email resets when logging in from a new computer.

The thing is, email was never designed for this purpose. Password managers are. I stay logged into my email client on my computer, but I have to retype my password to open my Bitwarden vault.