Hacker News Reader

The question is how do you recover it when you lose it?

For a password I just click the “I forgot my password” link, I get an email with a link to click, and my account is recovered within minutes. I have recovered 15 year old accounts this way.

If you can’t do that with passkeys, then the system is doomed to failure because people lose their credentials and devices all the time.

View on HN

You authenticate to a cloud escrow provider using any of your account's other associated devices. If you have none, because Yellowstone erupted while you were away, and someone also yoinked your phone in the ensuing chaos, then you input either (A) your device's passcode and an SMS code, or (B) a recovery key. If you have neither, then you use an established recovery contact. If those steps didn't work, then it's not too late to visit Wyoming.

Surely a system where you have a single point of trust and key backup is better than the current mess of using a single password on multiple sites, like most people do.

And no, the solution to that is not security education, people don't change and a system that expects behavioral changes without enforcing them is simply an insecure design. The truth of the matter is that passwords are insecure and problematic for the vast majority of non-technical people.

Reply on news.ycombinator.com