undefined | Better HN

0 pointsdiscardedrefuse2y ago0 comments

> Passkeys can make it harder to switch password managers because the password managers are designed not to let you copy-and-paste a passkey, including from Google's Password Manager to Apple's Password Manager.

This part right here is what I fear the most about Passkeys. I've read too many horror stories of people getting banned from Google (often for no valid reason) and losing access to all of their data. It is absolutely insane to hand over all your passwords to a company like this.

0 comments

mingus882y ago

I have been using passkeys for a while in the form of yubikeys

Best practice is to register two keys to every website. Keep one physically in a safe.

With password managers I would say the same basic practice applies. Make sure you have a working offline backup of whatever secrets you hold dear.

There are some sites that only allow you to register a single passkey for an account (AWS Console last I checked) but these should be getting fixed as it becomes more popular

Thrymr2y ago

> Best practice is to register two keys to every website. Keep one physically in a safe.

Well, this sounds convenient. Keep the second one in a safe, but register a key to it for every website you use.

Is this a practice we actually believe users will carry out?

mingus882y ago

Yubikey are $50 so if you are already investing real money in your online security it’s not a stretch to expect that people will spend extra time and money to keep a physical backup

I don’t bother with a safe. I have one key that never leaves my home desk and another I have on my keychain. It’s trivial to register the second key when I am home.

Yes it is less convenient than a digital passkey but there is absolutely no way for a remote attacker to compromise it

j / k navigate · click thread line to collapse

0 comments

mingus882y ago

I have been using passkeys for a while in the form of yubikeys

Best practice is to register two keys to every website. Keep one physically in a safe.

With password managers I would say the same basic practice applies. Make sure you have a working offline backup of whatever secrets you hold dear.

There are some sites that only allow you to register a single passkey for an account (AWS Console last I checked) but these should be getting fixed as it becomes more popular

Thrymr2y ago

> Best practice is to register two keys to every website. Keep one physically in a safe.

Well, this sounds convenient. Keep the second one in a safe, but register a key to it for every website you use.

Is this a practice we actually believe users will carry out?

mingus882y ago

Yubikey are $50 so if you are already investing real money in your online security it’s not a stretch to expect that people will spend extra time and money to keep a physical backup

I don’t bother with a safe. I have one key that never leaves my home desk and another I have on my keychain. It’s trivial to register the second key when I am home.

Yes it is less convenient than a digital passkey but there is absolutely no way for a remote attacker to compromise it

j / k navigate · click thread line to collapse