https://support.apple.com/guide/security/account-recovery-co...
(No, that doesn't mean that the contact has access to your account, the encryption key is split between the contact and Apple by the device.)
> And adding more devices is not the answer either.
Why not?
What's your ideal authentication solution?
Two things I'd love to see: Something like Mozilla Persona, and maybe SSH key authentication in the browser. No idea how I'd manage and back up my key though. Don't think it's easy for the broad masses eitehr.
> What's your ideal authentication solution?
I've said before as soon as passkeys can be managed offline and aren't tied to devices I'll be all in. Keepassxc is my preferred solution just now.
This sounds pretty good to me, this is therefore like a regular old password except it's a cryptographic key that I don't have to remember and it's secured by whatever device PIN or face unlock that the device has. I think this might have a chance to succeed. Unfortunately the UI popups they implemented are not good, they need to remove the "usb security key" option and hide it under an advanced options tab. Anyone who uses that is an expert, please only prompt for the default device verification, like Windows Hello or face unlock on an iPhone.
Also the fact that Chrome by default prompts for a QR code + mobile signin flow is a bit crazy to me, it seems they are very confident that everyone who has a desktop wants to login via phone. Which makes no sense to me, do I really want to use my phone to login to all my desktop applications? I don't think so, maybe younger people who only have laptops + phones do this but still.. why would this be the default, surely Windows Hello or whatever MacOSX uses on desktop is still faster than picking up my phone constantly. I tried it and I was very surprised that it almost worked flawlessly. It asked me to automatically turn on my bluetooth, it connected to my PC's bluetooth within seconds and actually created a working login for my desktop via my mobile phone. It's impressive that this worked... except for the part that the "sign up" popup on desktop never went away automatically!
That same link shows that not only is this unsupported on Linux, there are no plans to support it on Chrome Linux. That's a far cry from "like any password".
If it's just an API, is the issue that there needs to be a Linux provider that offers that API? Are there plans to work with the community to build one? Is that Linux provider going to run on custom kernels, or will it only run on a signed Ubuntu image?
As it stands today, I actually can't use Chrome's WebAuthn implementation on any of computers except through its back-up "use your phone" method, which is a lot more inconvenient. And Google is telling me it has no plans to support my computers. Meanwhile, if someone uses passwords, I can tell them to switch to Linux and I don't need to provide the caveat that they won't be able to log into any of their accounts now without using a phone.
So is my password, because I use (password manager).
Well that's part of the problem, isn't it? It is being treated as if it is 2FA, but in practice it is barely more secure than a cloud-synced password.
I mean, here's the thing, I already don't have to worry about a site's shitty security practices because I'm using a random password for each account. Sure, my email could be leaked, but it's available on my CV anyway so, uh, congrats?
Client side TLS certificates used in combination with username/password. Had browser vendors improved the UX experience in generating CSRs and storing certificates, then it could have been a viable option. The nice thing about this is that it's application level protocol agnostic. It could even be used for SMTP and IMAP connections instead of just being limited to HTTP like webauthn.
When I’m traveling and robbed, I won’t be able to get the backup device is hidden in my drawer at home
These are tradeoffs that people use to balance security. Many people will lose to a sim swap despite not needing access to their life savings while on vacation with absolutely no proof of identity and a fallible memory.
These are encrypted in my password manager that is sync'd to the cloud. I only have 1 password and 1 backup code I need to memorize.
Passkeys is relatively close to being a proper successor to Mozilla Persona. The UX isn't quite as polished as Mozilla Persona felt, but Passkeys is a multi-vendor coalition with Apple, Google, and Microsoft all throwing marketing weight behind it, so maybe the UX will never quite be perfect due to the intersection of all that, but the underlying tech is really close to what Mozilla Persona proposed, in a long, round-about away.
The backends are either cloud controlled (hence associated with your subscription) or device controlled (associated with the serial number, purchase, drm... ignore your fancy key, everyone will use the TPM in their laptop/phone). And yes, All protocols have similar restrictions to hide information from one side and another (publisher, relying party, etc) but none are better than the isolation you get today with same-origin. And those were put in place by the same advertisers, so it will not be a problem either.