undefined | Better HN

0 pointscarstenhag1y ago0 comments

So I should get locked out of all services when my device breaks?

0 comments

You should produce a key per device, and produce a backup key that is safely stored & not used anywhere.

You can recover if you lose all devices via your break-glass backup key, and you limit the blast radius of "my key got stolen" from rotating all your keys to just a single device (or maybe the more likely "I screwed up and pushed my key somewhere public")

crote1y ago

... which is completely nonviable if you connect to more than a single service.

I agree that you should use a different key per device, but when you connect to over a dozen different services/machines it quickly starts to become a serious chore to add another key. Have fun spending an hour enrolling your new device - provided you can even remember every single usage it should be enrolled with.

4ad1y ago

SSH certificates solve this issue.

AFAIK there is no equivalent for Passkeys.

j / k navigate · click thread line to collapse