undefined

points

[-]

Also from experience, most sites will implement it in every wrong way possible.

For example, all the major sites that allow the total of 1 active TotP authenticator app - trying to add one forces to delete the other. Which is fine while you have only one phone and aren't in the process of switching to another one.

by deltoidmaximus3 hours ago|

parent|

[-]

With foresight you can get around this since you can reuse the TOTP seed values.

The annoying thing is so many services don't even support TOTP. They either want their own proprietary app, still insist on SMS, some of them even try to get you to use voice prints!

by mhurron6 hours ago|

prev|

[-]

> These are all answerable questions, but getting those answers is confusing for most people.

It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.

by cpburns20095 hours ago|

parent|

[-]

So passkeys achieve nothing if you can already use strong, secure, random passwords stored in a password manager?

by fhdkweig5 hours ago|

parent|

prev|

[-]

Write it down on a sheet of paper and put the paper in a safe place. As a bonus, I can have multiple copies in multiple places. It is simple, easy, and I have been doing it all my life. I see no reason why it has to be more complicated than that.

by TeMPOraL6 hours ago|

parent|

prev|

[-]

Password managers are themselves cross-device footguns and I could easily write the same headline for them myself. I've been working in tech for 20 years now, and I don't use them.

ETA: Well I do use auto-fill in browsers/mobile, but funny thing about this, I have three running on my phone[0], they all activate at the same time, and they contain mostly non-overlapping set of credentials, and I got tired of trying to sync them together, so I just look up passwords manually one by one in each and use clipboard to transfer the credential once I find it.

And I had to stop using passkeys because they interact with this split-brain system in unpredictable ways.

[0] - Specifically: Google Password Manager / Google Autofill / whatever they call it, Samsung Pass / Samsung Wallet (they're sort of but not the same?), and auto-fill built into Firefox.

by AlexandrB4 hours ago|

parent|

prev|

[-]

Password managers for passkeys have a huge problem when dealing with any kind of remote support or working on someone else's hardware - you can't just copy/paste or type in the passkey so you're forced to install the password manager on a family member's/stranger's/employer's PC or do what? I'm not even sure. At least SSH keys have forwarding when you ssh to a remote machine, how do you "forward" a passkey?

by nozzlegear3 hours ago|

parent|

[-]

With Apple's Passwords app, you can create "groups" for passwords and passkeys and share them with people. Once shared, the passkey/password automatically fills as if it was that person's own.

I have a "Family" group in my Passwords app where I share passwords and passkeys with family members for exactly this purpose.

by nozzlegear3 hours ago|

prev|

[-]

Don't think it's any more confusing than e.g. logging in with an email address and password, or logging in with email + code, etc. A website's auth is usually a black box that they don't explain, and the only reason people find passkeys confusing is because they've been conditioned to enter passwords instead.