Hacker News Reader

Comment by fbdab103 | Hacker News Reader

Phones are fragile and get lost, stolen, or destroyed. I need a security system for which I am able to make an offline backup.

View on HN

Google’s implementation allows multiple passkeys. I have a passkey for my iPhone, one from Windows Hello, and 3 from different yubikeys I’ve picked up over the years. The yubikey implementation requires setting a PIN, so I’m not even really worried about one of them being lost of stolen.

Cloud you please elaborate in detail how someone not using Yubi keys should adopt it by having hardware keys and how much keys should one have?

How Keys are different than an OTP app like Authy?

The Apple security model for Apple ID and iCloud already works like this. Every device is effectively a “passkey” even if they don’t call it that. Been that way for a while now.

Every device (except accessories like AppleTV, HomePod, etc.) you log into iCloud with effectively has Super Admin control over your entire iCloud account. Any logged-in device can remove, modify, or change (almost) anything without a password… including the account password (hence the almost). Once authorized, that access is controlled by biometrics with a backup PIN. As long as you maintain control of a single device you have access to everything.

Yubikeys work the same way. Doubly so when dealing with resident credentials and passkeys. Key as as many as possible—just make sure the PIN is not obvious. If you hold the key and know the PIN, you can do anything. No other information is needed.

The big difference between this and OTP is two fold: 1) much more resistant against phishing; and 2) the underlying key is less likely (or impossible-ish) to be exposed. Phishing a 2FA OTP is actually not hard with a good fake UI. It just requires someone to act quickly on the other end or a good script that can quickly change the password/security settings once a password and OTP are successfully phished.

A lot of people in the world only have one primary digital device - a phone. If that phone breaks, or is lost or stolen, how do those users get back access to their keys? Will the store holders like Google and Apple validate their identity w/ personal information frequently stolen from credit agencies and healthcare industry data stores?

TOTP keys, written down, would probably be ideal for that.

TOTP written down does work well, but the parent and I are both interested in how we should write down (on paper, like by printing) the various secrets necessary to reconstruct our passkeys in an emergency. Once that's known, I'll gladly adopt passkeys.

Easy, buy a backup phone, rest easy and boost the economy.

What's wrong with an online backup? Offline backups are tied to their physical representation and can get lost in disasters for example. Spread your risk.

Moreso about providing the capability to roll your own backup. Online backups an be foiled if they only provide gdrive backup for example.

> What's wrong with an online backup?

If Google decides you have Done A Bad, suddenly you can't login to anything, anywhere.

That's like saying that all food is unhealthy because of McDonalds.

Online backup stuck inside Google's walls is the opposite of spreading my risk.

An offline backup I can control, I can put in a safe for my relatives in case I die unexpectedly. Or I am robbed. Or any number of foreseeable circumstances where the physical manifestation of my secret is lost.

AFAIK, you can use a physical key anywhere you can use a passkey [1]. And you can register multiple passkeys. So it would be perfectly possible to have your logins in a safe somewhere while having additional passkeys for daily use. You just need create the backup manually for each account provider. You can't extract all your passkeys from a device.

But for me, the online-backup provides enough redundancy. In order to be locked out, I'd have to loose all my devices and, at the same time, be banned by my cloud provider.

[1] at least that's what the Safari-UI suggests.

Reply on news.ycombinator.com