Hacker News Reader

Hacker News

Comment by atonse | Hacker News Reader

Full thread

atonse

I’m all for alternatives to passwords but what is the pathway for “I lost passkey”

Is it sending a reset to a recovery email?

View on HN

It is outside of passkey scope. Most services will use email to recover access.

> It is outside of passkey scope.

Yeah right, pass along responsability to someone else. And you wonder why people don't trust this "security" solution.

There's no reason not to trust it. It's strictly better than passwords in almost every regard. Of course if you manage your passwords well, you don't get more security with passkeys, because your account is already safe enough. But for someone, who used to write his universal "Johny1987" password on a sticker at his display, passkey provides security and usability benefits.

Passkey is just not supposed to solve all the problems in the world. It's supposed to replace login and password and that's about it. Authentication.

That would be fine if it didn't introduce device dependency and vendor lock in.

How do I get my keys out of Apple's wallet again? Or out of a Yubikey for that matter.

They are no longer under my control and I depend on Apple's or Yubikey's benevolence to access my services.

> Or out of a Yubikey for that matter.

You don't, and neither does an adversary. That is literally the whole point of paying $50 for a Yubikey.

So I need to pay for the privilege of having a single point of failure for my credentials :)

Oh no I forgot, I could pay even more to have backups.

It's an open specification. You can make your own if you like.

If the security properties of a hardware authenticator aren't important to you, you don't need to use one at all.

A phone is also a hardware authenticator in this case. With the same problems in case of theft/destruction.

Basically the same as if you had lost a physical key:

You either have an extra set up or you work around the problem through some kind of recovery method.

A trusted third party has a copy of the physical key to my flat. I handed them over once and they still work. I can print out the passwords and 2FA keys required to recover the most basic services (such as primary email and password manager) — as long as I don't change the credentials, it will keep working. But if I use passkeys stored on device, what are my recovery options? Do I need to retrieve the backup device every time I create a new passkey?

multiple passkeys

Reply on news.ycombinator.com