Hacker News Reader

Comment by oefrha | Hacker News Reader

If I lose my phone I don’t lose my passwords to begin with, because I have my most important account passwords written down somewhere, including the one for the email account used for recovery flows. Strings are an open system after all. TOTPs are slightly more involved but even a layperson can save an image of the original QR code, in addition to recovery codes.

The misconception here is your setting up a strawman.

View on HN

So your only change would be needing to store a recovery code instead of the password.

Password managers like Bitwarden allow you to store passkeys too. Ofc, that only works for services that let you create & use your own passkey, rather than force you to use one managed by them.

Is the strawman that passkey are only available via one device, your phone? Because Google and Apple sync passkeys to devices logged into their respective accounts, so assuming you own a laptop or ipad/tablet, or have an old phone, your passkeys are also available on that device.

Except if you're relying on "an old phone" as your backup device, you'll find you don't have access because you haven't powered it on to sync passkeys, and Google expired your login anyway as you haven't used it on that device in months.

FYI both Google and Apple have an account recovery flow that works even if you lose 100% of your devices.

I once used Google’s account recovery flow on an old dormant (for maybe three years?) account. Did everything asked and reached a state where they wouldn’t ask me to do anything else to demonstrate ownership but I’m still suspicious or something like that. Fortunately I had nothing important there. Pro tip: operate as if Google doesn’t have a recovery flow at all.

This is not true for Google at least. I have been locked out of a secondary google account because they thought it was suspicious that I logged in from a new IP address after 6 months of disuse. I have the password, I have the TOTP codes, I have the recovery email (in fact I even have the email for that account, as it forwards to my primary account), but login is just not allowed until I accept a push notification on a destroyed device.

For some reason, my primary account was not subject to the same probablistic lockout, maybe because it had a more constant record of use, or maybe because it was a GApps account.

Reply on news.ycombinator.com