Hacker News Reader

Comment by andix | Hacker News Reader

This was always driving me crazy about webauthn, that you couldn't sync it between devices. You always had to add at least a few devices, not to lose access if you lose a device. And keep track of all services, so you can add new devices if you change them. Not very practical.

I try always to disable email or SMS 2FA/recovery, because I deem them to be rather unsafe.

Btw Bitwarden announced to support pass keys soon ("in October").

View on HN

Hardware keys don't want to transfer the private key out of the hardware gadget, because that compromises the security model. That's their whole point, you can't extract the secrets, the hardware would rather self-destruct than expose the secret. Lack of "sync" (while retaining ease of transferring the key between computers) is the the primary purpose of a hardware security key.

You're opting to a lower security level by wanting something that can be synced.

> You're opting to a lower security level by wanting something that can be synced.

I don't think most users care

I do care about security, but if I lose my yubikey and i can't backup it, then I need to keep some (insecure) account recovery options enabled.

If I can backup my passkeys, then I can disable them.

Yubikey advise you to buy two keys and keep one with you and one in a safe space, only used for recovery. That requires the service you use it on to allow multiple keys though, and that’s unfortunately not always the case.

But you always need the second one to set it up for each service.

It's fine if you do that for two or three services. But my password manager has around 600 entries. If I would need to set up all of them on both keys and always switch the active one with the one in the safe location for setting up a new account I would go crazy. Having both of them in the same place kind of defeats the purpose of having two keys, as you would lose them together.

So better have a synced password manager and unlock the password manager with a hardware key.

Reply on news.ycombinator.com