Hacker News Reader

Comment by barkerja | Hacker News Reader

1. I don't believe you can, but I could be wrong.

2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS.

3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account.

4. I don't believe this is an issue specific to Passkeys.

5. Account recovery isn't really necessary, unless you hit up against point 3, in which case it's about recovering your ability to use the passkey and not so much the account.

6. If emails are being treated as usernames, they absolutely should be validated.

View on HN

> Account recovery isn't really necessary,

Unless you want to switch from Safari to Chrome, I guess?

I would assume so, but I'm not 100% sure. I personally haven't yet messed with Passkeys much aside from use on a couple of sites that have implemented them.

My working assumption is if you wanted to use a new browser, you'd have to attempt to log into the service with the new browser. When the Passkey flow prompts you with a QR code to scan, you'd have to use your iPhone/iPad to scan that QR code to allow entry. What happens after that, I have no clue.

Part of the design is that every site will support multiple passkeys tied to an individual account. So it will be normal to use one browser to bootstrap registering another browser with a new passkey into your account. This video[1] by the FIDO alliance shows what that process will look like with a bunch of different OS and browser combos.

[1]: https://www.youtube.com/watch?v=SWocv4BhCNg

The keys aren’t stored in the browser. The browser just forwards to the hardware.

Switching from one password/-key manager to another is going to be more of an issue.

But you should be able to add an additional passkey once logged in to an account, just like how you can have multiple hardware 2fa keys now. Then you could manually migrate accounts that way, which is painful, of course, but you wouldn’t be completely locked in.

I use both chrome and safari, and hate they don't use the same password store anymore (chrome used to just use keychain). But on iOS, you can at least fill in passwords using chrome as well

Reply on news.ycombinator.com