Hacker News new | past | comments | ask | show | jobs | submit login

But 1Password syncs your passkey to all your devices, so you only have one.



Don't worry, if you lose your passkey all you need is access to your email to receive a password reset link. </sarcasm>


That's literally the solution to "What if I lose all the passkeys associated with my account and I've also forgotten my password?"


The major problem with passkeys is that first they were poorly designed so there's no portability or ability to enroll an offline (or worse, physically unavailable, like stored in a safe) authenticator, then there's this kludge to work around the limitation.

It was obvious from day 0 (to anyone except for Apple and Microsoft) that people do have multiple devices and not all of them are from a single vendor. My only explanation is that they deliberately decided to ignore this aspect, because it wasn't in corporate interests.

They made it significantly easier to lose all the passkeys, because they made it very hard to add multiple passkeys (you literally have to walk/run/drive/fly and grab every different device you have, get it online and register - or get properly locked in with a single vendor and pray they work for you, forever).

Carrying a Yubikey does not work (you can lose it). iCloud/Windows Hello does not work (you can be on a non-Apple/Microsoft device). 1Password is better but still does not really work (you can lose access to your account). They're all SPOFs, and avoiding SPOF was deliberately made hard (you can't easily enroll a "backup" Yubikey that you don't have at hand, and if you have it at hand it's not a backup anymore).

Heck, "official" demo at passkeys.io doesn't even bother to showcase how multiple passkeys are going to be a thing at all, which is an obvious red flag.

That is, not to mention that a growing number of vendors contributed to the crappiness by limiting what kind of authenticators and which platforms one can use (BestBuy, PayPal and so on), contributing to decreased security and increased headaches.


Except for when it happens to your email account.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: