Passwordless.id – Screenshots | Hacker News Reader

Passwordless.id – Screenshots

blog.passwordless.id

33 pointsdagnelies12 comments

I remember Microsoft making an announcement more than a year ago -- saying they are developing a way of passwordless authentication. Wonder what happened to that initiative. Have not seen much about that in recent times.

I think it's webauthn, same thing being used here. Local device has a keystore, you can access it with face, fingerprint, PIN etc.

what happens when you inevitably lose said device and/or it lets out the magic smoke?

Hi, sorry for the late reply. That is why in the screenshots you see the part with "account recovery options". Although there is the classical way with emails/sms, the other way would be to register an additional device for the account, for example by scanning a QR code, like in the screenshots.

Moreover, Google/Apple/Microsoft password's manager may sync your passkeys/credentials across your devices if enabled.

My understanding is that something in the TPM cannot be exported.

https://learn.microsoft.com/en-us/windows/security/identity-...

https://learn.microsoft.com/en-us/windows/security/informati...

> sign in/up in web apps using their fingerprint, face recognition or local authentication mechanisms like swipe pattern or PIN code.

Worth adding wallet login too.

How is a pin code or swipe pattern safer than a password?

What happens if you lose access to your devices and only have a friends computer, how do you log in to things?

The pin or swipe pattern is used to unlock access to the private key that you actually use to sign in with. Much like having a pin to decrypt your ssh key.

The article covers this by suggesting that users should configure multiple devices to the service and at least with Apple’s passwordless implementation you have the option to save the private keys in your keyring to icloud. As long as you can gain access to your iCloud account and restore your keyring you shouldn’t lose access to your accounts.

Additionally, most accounts (like gmail) allow you to make recovery codes that you could backup, write down, and otherwise store someplace offline and safe so if you cannot use your passwordless login you could gain access that way.

I can send you some ios screenshots

Sorry for the late reply. That would be super awesome! Could you submit them directly here https://github.com/passwordless-id/www if you have a github account. Or do you prefer my personal email?

ui.passwordless.id: type error: i.getPublicKey is not a function

Thanks for the info. It's Firefox right?

Reply on news.ycombinator.com