Hacker News Reader

Comment by hresvelgr | Hacker News Reader

> I use a Yubikey and Passkeys all the time, in a business context where there is an IT admin to go to when there is a problem, I think Passkeys will do great. They'll really improve the average security posture of an organization.

The average user of a service will be worse off for passkeys. Something as innocent and common as losing a phone could result in complete account lockout.

Magic links offer the best compromise between security posture, effort to implement for developers, and easiness for users. It's not the perfect solution, but its the best at the moment across all dimensions.

View on HN

>Something as innocent and common as losing a phone could result in complete account lockout.

This is the biggest misconception I see repeated about passkeys constantly. Account recovery flows generally do not change at all. Passkeys replace passwords, they change nothing at all about account recovery. If you forget/lose your password or your passkey, you go through the reset flow and create a new one.

If you lose your phone you may also have lost access to your email, if you used a passkey to sign into that.

If you lose your phone and you only have your phone to access your email, then you also have lost access to your password if you're using a strong password and a password manager.

Or do you remember a 20+ random character string for each site and thus do not need a password manager?

My email and password manager are actually the two unique passwords I do remember (the rest are in my password manager). So losing my phone does not mean I lose access to them. I _have_ actually lost all my electronic devices in a house fire, so this is from experience.

2FA does make this more complicated and in my case my password manager did not have 2FA, but TOTP with backup codes does let you store those backup codes somewhere else, while none of the passkey implementations I have seen (Fastmail, Amazon and Toggl) have an equivalent to the backup codes for TOTP. The fact that they still support password auth is probably their failsafe here, but this assumes that password auth continues to exist, which is contrary to to the goals of passkeys.

>I _have_ actually lost all my electronic devices in a house fire, so this is from experience.

I can't speak to other passkey managers, but both Google and Apple have pretty thorough account recovery flows that work even if you lose 100% of your devices.

Google regularly asks me for annoying things even when I have all my credentials. What’s their account recovery flow? I’m not sure I trust it to be good.

I just had to go through it for a friend who had forgotten their Google password. It was good. Tbh it would be more surprising if it was bad since they have millions of users. So the amount of people who go through that flow every day is probably very high in terms of absolutes numbers, even if it’s only a small percentage of users. And Google is known to do a shitload of A/B testing anytime they tweak their UI/UX.

So yeah I think it would be way more surprising to me if this particular flow was bad. If anything it’s likely to be one of their _best_ flows, given their scale and how critical of a flow it is.

And given that they love to track users to serve them ads, it’s also very much in their (capitalist) interest to make sure users don’t get locked out of their accounts.

That has not been my experience with Google, as detailed in the other time you sent this reply.

That’s why you don’t create a passkey for the service that manages your credentials.

Use a pair of yubikeys.

BTW, all major email providers have a flow to allow you to recover access to your account.

When you enable passkeys it doesn’t suddenly deactivate every other way of logging in.

That’s definitely not the position most passkey proponents take.

If I lose my phone I don’t lose my passwords to begin with, because I have my most important account passwords written down somewhere, including the one for the email account used for recovery flows. Strings are an open system after all. TOTPs are slightly more involved but even a layperson can save an image of the original QR code, in addition to recovery codes.

The misconception here is your setting up a strawman.

So your only change would be needing to store a recovery code instead of the password.

Password managers like Bitwarden allow you to store passkeys too. Ofc, that only works for services that let you create & use your own passkey, rather than force you to use one managed by them.

Is the strawman that passkey are only available via one device, your phone? Because Google and Apple sync passkeys to devices logged into their respective accounts, so assuming you own a laptop or ipad/tablet, or have an old phone, your passkeys are also available on that device.

Except if you're relying on "an old phone" as your backup device, you'll find you don't have access because you haven't powered it on to sync passkeys, and Google expired your login anyway as you haven't used it on that device in months.

FYI both Google and Apple have an account recovery flow that works even if you lose 100% of your devices.

This is not true for Google at least. I have been locked out of a secondary google account because they thought it was suspicious that I logged in from a new IP address after 6 months of disuse. I have the password, I have the TOTP codes, I have the recovery email (in fact I even have the email for that account, as it forwards to my primary account), but login is just not allowed until I accept a push notification on a destroyed device.

For some reason, my primary account was not subject to the same probablistic lockout, maybe because it had a more constant record of use, or maybe because it was a GApps account.

I once used Google’s account recovery flow on an old dormant (for maybe three years?) account. Did everything asked and reached a state where they wouldn’t ask me to do anything else to demonstrate ownership but I’m still suspicious or something like that. Fortunately I had nothing important there. Pro tip: operate as if Google doesn’t have a recovery flow at all.

Reply on news.ycombinator.com