Hacker News Reader

Comment by brundolf | Hacker News Reader

Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue

View on HN

I like this idea of authenticating yourself by typing things in.

Seems like it'd be a little annoying to pick different things to type in for each service, maybe we could manage those, but still have a primary 'thing to type in' to the 'thing to type in' manager, which would then handle choosing and typing the various things into the various authentication boxes.

Even better, that manager could be used to log you in cryptographically, so you’re secret never leaves the device for authentication purposes.

https://bitwarden.com/passwordless-passkeys/

But how can i be sure it’s really you? How can i track you that way?

And it would be completely independent of vendor or device. Should write a paper on it.

Seriously, just tried passkey on an Android phone of mine with a burner account. I would not recommend this to anyone. Passkey as a tech might not be the issue, but the lacking option of just removing devices and passkeys freely from your account is just not acceptable. The vendor simply has different ideas about security than I have and it is not just restricted to serving me "safer" ads.

The point is that the private key resides on a tamperproof piece of hardware. Malware, viruses, or shoulder surfers cannot copy the key.

The solution is to set up multiple pieces of secure hardware, not writing down the keys to the castle on a piece of paper.

Great so now people need to be rich enough to own multiple phones? Really. The solution can’t be “buy multiple devices” when the average person can barely afford to maintain one working device.

Your computer can also be a passkey. I currently use both my laptop and my computer as a passkey, and a USB drive. So I have 3 backups to my Google account.

It is true that you do need to be rich enough to own a phone and ~100 USD of something else (laptop or USB), which does put redundancy out of the reach of a large portion of the world. But then they can just use regular 2fa at the expense of not being phishing-proof.

You have to be within several layers of bubbles to not see how small a percent of the general population are going to even understand any of this BS.

Things being this complicated makes them a non-starter. A nerd vanity project.

And this isn’t a knock on the “intelligence” of the general population. They quite rightfully won’t want to spend their limited time on God’s earth learning about all this.

Yes, but in order to add new items to each piece of hardware you have to be physically co-located with all the pieces of hardware you want to use as your backups. Which means they cannot be geographically distributed (or if they are that there is a period of time in which you aren't fully backed up). Which means you're either in a place where you can loose all your keys (e. g. a house fire or a flood) or your in a place where you can loose all the devices that have a key.

It's still a stronger key than virtually any password would be, and is (to my understanding) resistant to data breaches

But information sovereignty is crucial when it comes to this stuff; losing that is a regression that will cause problems

I'm much more concerned about my access being tied to physical hardware than I am about "malware".

How many of those devices do you think people are willing to buy, keep updated, AND store off site? A fire, car accident, flood, or major theft could wipe multiple devices out in one fell swoop. Unless there's a secure way to make passkeys portable and able to be backed up in a secure manner off-site, I will avoid this tech like the plague.

Google has backup codes for this purpose.

Funny story, if you’re using TOTP (the time-varying code thing like in Google Authenticator), you can save a picture of the QR code and reuse it later and it will still work.

Reply on news.ycombinator.com