upvote

points

by izacus5 hours ago |
comments
upvoteby cpburns20095 hours ago|
next
[-]
How do you use a restored passkey from backup? Aren't they locked to the device?
reply
upvoteby fhdkweig5 hours ago|
parent|
next
[-]
That's all I want to know. How do I restore from a backup? Specifically, a backup that I make to a medium I control, like a piece of paper or a burned CD-R in a safe deposit box. If I could get a good answer to that, I could be onboard. But from the conversations that I am getting here, it looks like only certain managers allow it, and with device attestation, they could be banned at any moment by any website with no recourse.
reply
upvoteby nozzlegear4 hours ago|
parent|
[-]
> * and with device attestation, they could be banned at any moment by any website with no recourse.*

Isn't this true of any authentication method? It doesn't seem unique to Passkeys.

reply
upvoteby fhdkweig3 hours ago|
parent|
[-]
Now that I think about it, you are right. But if they could ban my use of written passwords as easily as banning my use of a particular passkey device, why go through all the extra hoops to just be as vulnerable as before? This seems like a whole lot of extra work to do that gains me nothing.
reply
upvoteby fhdkweig1 hours ago|
parent|
[-]
I think it is important to explain why I and others are so reluctant to this.

In security, you identify reasonable threats. You can't protect against all of them, and some may even be contradictory.

When I get a call on my phone that says "Potential Spam", I have never even once in my life decided to run over to my list of passwords and hand them over to the President of the Spanish National Lottery. Not even once.

But on many, many occasions I have dealt with a simple system that was replaced by a more complicated one and something in that Rube Goldberg machine broke down and deprived me of access to money, email, even a parking permit to my office.

Passkeys seem to protect against the former case that has never happened to me, while increasing the chances of the latter that has happened way too often.

reply
upvoteby nozzlegear4 hours ago|
parent|
prev|
next
[-]
If you use Safari, they're locked to all of the devices on your iCloud account, not to a single device.
reply
upvoteby izacus1 hours ago|
parent|
prev|
[-]
I login to 1Password on another device and all passkeys are there, and usable.

The OSes I use where that works fine:

- Android - Windows - Linux - macOS - iOS

reply
upvoteby juancn4 hours ago|
prev|
[-]
How? Where are they stored? Which password protects them? How do I back them up? How do you move them to another device? Can I print them out on paper as a last resort measure?

Nobody fucking knows.

reply
upvoteby pas3 hours ago|
parent|
[-]
it depends on which password manager you are using. if you use Google's then it gets backed up to your Google account.

BitWarden, KeePassXC, and probably a bunch of other password managers have very thorough support for import-export, automatic/periodic backup, sync/merge, etc.

reply
upvoteby juancn19 minutes ago|
parent|
[-]
And that's a HUGE issue. SSH keys are easy to manage in comparison to PassKeys.
reply