Hacker News Reader

Comment by djrj477dhsnv | Hacker News Reader

If I can't export the private key to my own backup solution, I don't want it.

Password managers sync passkeys just fine. If you use one of those, the benefit of passkeys is that some sites skip their SMS 2fa if you use a passkey. The downside is that you can only use them from your own devices, where you have the app/extension.

I don't think skipping 2FA is a benefit. Sure, replace SMS with passkeys or TOTP or literally anything else, but don't actually take away my second factor, please!

Having to pointlessly copy aroudn TOTPs from the same device is just security theater. There's no meaningful security difference for 2FA whether you actually need to copy around those tokens or if you click "authenticate with the key in app on my second factor device".

It's still 2 factors. Just with less hassle (and resulting in more security due to better UX).

Skipping SMS is an obvious benefit. Your passkey management system can embed as many factors as you want.

Placing a bunch of factors into 1 system is a giant SPoF like storing TOTPs with corresponding passwords within the same password manager. It defeats the whole purpose of 2+FA.

> Password managers sync passkeys

0. Which Password manager(s)?

> just fine

1. Sync where and with whom?

2. And are you including or excluding export and/or import too?

You provide no evidence for your claims.

PKs are being used as 1 factor mechanisms. That's centralizing a whole lot of trust.

I use Bitwarden, self-hosted.

> You provide no evidence for your claims.

I don't think I'm interested in this conversation.

Reply on news.ycombinator.com