12 ms·

>exposing yourself to the mercy of a single organization The nice thing about passkey is that unlike password, you can have multiple per account. So you can r

>exposing yourself to the mercy of a single organization The nice thing about passkey is that unlike password, you can have multiple per account. So you can register a passkey from 1password to website A, and also register a passkey from Apple keychain to website A, and also register a passkey from Google account to website A, and also register a passkey from yubikey to website A, so even if you are locked out from one of your accounts, you still have several other ways to log into your account at website A. And _if_ your, say, Apple keychain is compromised, you can just revoke the passkeys from your Apple keychain from all the websites (yes it's tedious, but it's doable).

efitz 2y ago
Having to have multiple passkeys per site to circumvent vendor identity lock-in is one of the main problems with passkeys.
- shim__ 2y ago
  I'd be so easy if this proposal were implemented: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco... one could always register one or more additional keys without having access to them.
  - buran77 2y ago
    A door can be kicked in, a safe can be drilled, a password can be reset. But these keys (whether a phone or a Yubikey) to your digital life are irreplaceable if they're all lost. We've never been in this situation before. The problem with any solution relying on a couple of physical devices as the sole access to your digital life is that the management and protection of those objects becomes one of the most important things in your life. These keys are supposed to give perfect security so by design making "software" copies brings that security to the level of passwords. But losing them kills your digital life. You have two keys in the house and you have a fire or severe natural disaster? There's no reset for them and you just piled a tragedy on top of another. You want to restore them from a backup? You probably need the keys to begin with. People need one on them at all times, one at home, one or two in some other safe far away location but to still trust that they won't be misused there. That's all people hear when they look into passkeys. "One more key" is not enough for most people, tech savvy or not.
theamk 2y ago
Even if it's possible technically, I don't think it's very practical, as UX is very heavily directed towards a single passkey provider. I can imagine doing this for one or two most important websites, but not for each of dozens (hundreds?) websites users have registeration on.
- gsich 2y ago
  Those websites are unimportant enough to just use normal passwords.
- fishywang 2y ago
  I'm not sure what UX you are talking about, the majority of the websites supporting u2f/passkey have UX to manage your u2f keys/passkeys. (the only exception I can think of is early Twitter when it first implemented u2f, and at that point it only allow you to add a single u2f key, but even Twitter fixed that later and supports multiple keys now). And (this is probably not emphasized enough) you really should never only use a single u2f key/passkey for a website, that's the recipe to get you locked out when you can't find your u2f key/get locked out of the provider of your passkey. I have at least 2 yubikeys on my keychain all the time (one for usb-a and one for usb-c), plus one for each of my computers, and passkeys from 1password, google, etc.. And whenever I add u2f keys/passkeys to a website I add all/most of them.
  - bobbruno 2y ago
    ...and you just described why this is not ready for prime time. Managing a number of physical devices tied to completely opaque secrets stored by unclear providers in places you never see, with hidden agendas promoting their locked-in solution over all others and complicating everything out of one ecosystem. Most standard users will either mess up royally or run away scared. Damn, I've been on this field for 30 years, I've been using 4 OSs, 5 different browsers and devices from every ecosystem, and I still find this whole thing too much of a hassle. And yes, I do have a backup passkey. Even though I had to convince my skip-level that it made sense. I just find it all too complex to adopt it broadly.
  - theamk 2y ago
6510 2y ago
> And _if_ your, say, Apple keychain is compromised, you can just revoke the passkeys from your Apple keychain from all the websites (yes it's tedious, but it's doable). without the key?
FireBeyond 2y ago
> The nice thing about passkey is that unlike password, you can have multiple per account. I would charitably estimate that of the sites currently supporting Passkey, the ones that support multiple passkeys are in the single digit percentage. So, practically, you can't.
- vel0city 2y ago
  As someone who actually uses them in a lot of places, the number of sites I know that only allows a single passkey is one: PayPal. What other sites do you know only allow a single one?
  - tzs 2y ago
    PayPal allows multiple passkeys. I just added passkeys there today and had no trouble making two. I have a vague recollection of running into some trouble when I tried to add passkeys to an account in their sandbox (sandbox.paypal.com) but don't remember what it was. I realized I don't need any of my sandbox accounts any more and deleted them all from my password manager rather than try to solve the problems. :-)
    - vel0city 2y ago
      They do now? That's good to hear. It's been probably close to a year since the last time I checked. Thanks for the update on that. So then that really makes me wonder what all those other sites these people are using which do only allow a single passkey.
      - tzs 2y ago
        I haven't run across any single key sites. PayPal's handling of multiple passkeys is kind of annoying. I didn't see any way to change the default labels it gives them, which appear to be simply the OS and browser names. So both of my passkeys are labeled "macOS Chrome". Clicking on them tells when they were created but the resolution is only to the day. If somehow my private key for one of the them leaked and I wanted to delete the public key I wouldn't know which to delete. Some sites label the passkeys "1Password" and something like "Apple iCloud" which works a lot better. I too first experimented with passkeys about a year ago, and then largely ignored them until this discussion prompted me to have another go. A year ago I found them almost unusable. I had trouble getting browsers to recognize a passkey was available for a site, and I had trouble getting browsers on my Mac to use passkeys from the Apple keychain on my Mac. They would often put up a QR code for me to scan on my phone to use the passkey from the phone--and that was also not very reliable. Now I'm hitting almost no problems. There are still some settings annoyance with some sites. At PayPal for instance it asks for my TOTP code even when logging in with a passkey. There is no option to turn off TOTP for passkeys but leave it on for passwords.
rcxdude 2y ago
Without a standard automatable way of doing this, it doesn't happen in practice, even assuming people implement it competently enough to allow multiple passcodes (TOTP codes, for example, are often only one per account, which is similarly annoying for maintaining a revocable backup)
lostmsu 2y ago
Ha, tell that to Apple. Last time I logged in to their App Connect it said that passkey can only be used from iOS or MacOS device.

efitz 2y ago

Having to have multiple passkeys per site to circumvent vendor identity lock-in is one of the main problems with passkeys.

shim__ 2y ago
I'd be so easy if this proposal were implemented: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco... one could always register one or more additional keys without having access to them.
- buran77 2y ago
  A door can be kicked in, a safe can be drilled, a password can be reset. But these keys (whether a phone or a Yubikey) to your digital life are irreplaceable if they're all lost. We've never been in this situation before. The problem with any solution relying on a couple of physical devices as the sole access to your digital life is that the management and protection of those objects becomes one of the most important things in your life. These keys are supposed to give perfect security so by design making "software" copies brings that security to the level of passwords. But losing them kills your digital life. You have two keys in the house and you have a fire or severe natural disaster? There's no reset for them and you just piled a tragedy on top of another. You want to restore them from a backup? You probably need the keys to begin with. People need one on them at all times, one at home, one or two in some other safe far away location but to still trust that they won't be misused there. That's all people hear when they look into passkeys. "One more key" is not enough for most people, tech savvy or not.

theamk 2y ago

Even if it's possible technically, I don't think it's very practical, as UX is very heavily directed towards a single passkey provider. I can imagine doing this for one or two most important websites, but not for each of dozens (hundreds?) websites users have registeration on.

gsich 2y ago
Those websites are unimportant enough to just use normal passwords.
fishywang 2y ago
I'm not sure what UX you are talking about, the majority of the websites supporting u2f/passkey have UX to manage your u2f keys/passkeys. (the only exception I can think of is early Twitter when it first implemented u2f, and at that point it only allow you to add a single u2f key, but even Twitter fixed that later and supports multiple keys now). And (this is probably not emphasized enough) you really should never only use a single u2f key/passkey for a website, that's the recipe to get you locked out when you can't find your u2f key/get locked out of the provider of your passkey. I have at least 2 yubikeys on my keychain all the time (one for usb-a and one for usb-c), plus one for each of my computers, and passkeys from 1password, google, etc.. And whenever I add u2f keys/passkeys to a website I add all/most of them.
- bobbruno 2y ago
  ...and you just described why this is not ready for prime time. Managing a number of physical devices tied to completely opaque secrets stored by unclear providers in places you never see, with hidden agendas promoting their locked-in solution over all others and complicating everything out of one ecosystem. Most standard users will either mess up royally or run away scared. Damn, I've been on this field for 30 years, I've been using 4 OSs, 5 different browsers and devices from every ecosystem, and I still find this whole thing too much of a hassle. And yes, I do have a backup passkey. Even though I had to convince my skip-level that it made sense. I just find it all too complex to adopt it broadly.
- theamk 2y ago

6510 2y ago

> And _if_ your, say, Apple keychain is compromised, you can just revoke the passkeys from your Apple keychain from all the websites (yes it's tedious, but it's doable). without the key?

FireBeyond 2y ago

> The nice thing about passkey is that unlike password, you can have multiple per account. I would charitably estimate that of the sites currently supporting Passkey, the ones that support multiple passkeys are in the single digit percentage. So, practically, you can't.

vel0city 2y ago
As someone who actually uses them in a lot of places, the number of sites I know that only allows a single passkey is one: PayPal. What other sites do you know only allow a single one?
- tzs 2y ago
  PayPal allows multiple passkeys. I just added passkeys there today and had no trouble making two. I have a vague recollection of running into some trouble when I tried to add passkeys to an account in their sandbox (sandbox.paypal.com) but don't remember what it was. I realized I don't need any of my sandbox accounts any more and deleted them all from my password manager rather than try to solve the problems. :-)
  - vel0city 2y ago
    They do now? That's good to hear. It's been probably close to a year since the last time I checked. Thanks for the update on that. So then that really makes me wonder what all those other sites these people are using which do only allow a single passkey.
    - tzs 2y ago
      I haven't run across any single key sites. PayPal's handling of multiple passkeys is kind of annoying. I didn't see any way to change the default labels it gives them, which appear to be simply the OS and browser names. So both of my passkeys are labeled "macOS Chrome". Clicking on them tells when they were created but the resolution is only to the day. If somehow my private key for one of the them leaked and I wanted to delete the public key I wouldn't know which to delete. Some sites label the passkeys "1Password" and something like "Apple iCloud" which works a lot better. I too first experimented with passkeys about a year ago, and then largely ignored them until this discussion prompted me to have another go. A year ago I found them almost unusable. I had trouble getting browsers to recognize a passkey was available for a site, and I had trouble getting browsers on my Mac to use passkeys from the Apple keychain on my Mac. They would often put up a QR code for me to scan on my phone to use the passkey from the phone--and that was also not very reliable. Now I'm hitting almost no problems. There are still some settings annoyance with some sites. At PayPal for instance it asks for my TOTP code even when logging in with a passkey. There is no option to turn off TOTP for passkeys but leave it on for passwords.

rcxdude 2y ago

Without a standard automatable way of doing this, it doesn't happen in practice, even assuming people implement it competently enough to allow multiple passcodes (TOTP codes, for example, are often only one per account, which is similarly annoying for maintaining a revocable backup)

lostmsu 2y ago

Ha, tell that to Apple. Last time I logged in to their App Connect it said that passkey can only be used from iOS or MacOS device.