Hacker News Reader

Comment by juancn | Hacker News Reader

What if I lose all my apple devices? House break-in and they steal my mac and my phone?

You're basically fucked even if you buy a new one because you need one of the other two to log in.

Then you'll login to your Apple iCloud account using your password.

Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.)

No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).

No technology in the world can protect you against every threat model and unlikely scenario.

What if the robber hits you in the head and you get brain damage and forget your password?

Master password to password vault stored on metal, buried in my backyard and I tell a family member where it is in case I ever get brain damage

Family member gossips "that crazy [deejaaymac] always burying secrets in the backyard..."

Or straight up betrays you (you slighted them at some family event)

If you marry someone you don’t trust, you’re going to have a lot more problems than password compromise.

That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.

Did not know that - how well does it work?

That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).

A password has the best recovery process. Period. Write it down somewhere. It's up to me, no third party.

I had more trouble with a failed 2FA than with a password.

Reply on news.ycombinator.com