News for hackers. Stuff that matters.
Re:Microsoft Confirms Password Deletion for 1B Users by iggldiggl on Thursday December 19, 2024 @06:53AM (#42460601)
> And most sites only allow one passkey per account because all the mobile implementations can sync the private key.

Even when/if sites do allow multipe passkeys per account, the fundamental contradiction remains: Your backup key(s) are supposed to be kept somewhere secure where they won't get lost, stolen or destroyed, which ideally means some sort of off-site backup (at your bank or whereever), but at the same time every time you register for a new service you do need to register all your backup keys, too.

Re:Microsoft Confirms Password Deletion for 1B Users by wkat4242 on Saturday December 21, 2024 @01:17AM (#42477855)
True. That is a problem. Especially because with Webauthn you can't just enrol a public key. It's one of the reasons I like openpgp for authentication e.g. over SSH. I can just give it a list of public keys to accept without having all those keys actually to hand.