GitHub announced today the introduction of passwordless authentication support in public beta, allowing users to upgrade from security keys to passkeys.
Maybe I’m misinterpreting something here, but wouldn’t that mean, I can’t just access my account if I lose my auth device? Am I supposed to always have a passkey device locked somewhere safe?
My understanding is that these passkeys can be securely synced - either via your device cloud (e.g. iCloud), or hopefully soon via your password manager. So not that different in terms of UX than current 2FA, but more secure in the backend.
I just tried this out with Github. My passkey lives in 1Password so it’s backed up and synced across devices. It also lets me sign in with normal MFA/TOTP if I don’t have the passkey, or use a recovery code. Incidentally @[email protected] this is working in Firefox now.
Passkeys use a challenge/response protocol that doesn’t transmit any actual secrets. This makes them phishing resistant as you can’t just “type in your passkey secret” it gitnub .com
You’re supposed to have multiple devices (phone, tablet, laptop, desktop, etc) that all store your passkey securely (it can’t just be sitting on the SSD…). You’re also supposed to backup your passkey.
Yes, if you lose access to all your devices it could prove challenging to access GitHub… but that’s a pretty unlikely scenario and most people should be willing to pay the price (what self respecting programmer travels anywhere without two or three devices?)
You are also supposed to backup everything you have on GitHub elsewhere… so it shouldn’t be a total disaster if you lose access. It’d just be annoying. And presumably GitHub has some kind of recovery process for someone who’s lost access to an account? What if the repository maintainer dies? Someone else has to be able to take over.
On the other hand - if my bank required a passkey… then I’d probably switch banks. If all my stuff is stolen or destroyed, I still need access to my money. And if someone compromises my bank… well it’s just money. The stakes are far higher if a popular GitHub repository is compromised.
Maybe I’m misinterpreting something here, but wouldn’t that mean, I can’t just access my account if I lose my auth device? Am I supposed to always have a passkey device locked somewhere safe?
My understanding is that these passkeys can be securely synced - either via your device cloud (e.g. iCloud), or hopefully soon via your password manager. So not that different in terms of UX than current 2FA, but more secure in the backend.
I just tried this out with Github. My passkey lives in 1Password so it’s backed up and synced across devices. It also lets me sign in with normal MFA/TOTP if I don’t have the passkey, or use a recovery code. Incidentally @[email protected] this is working in Firefox now.
So, it’s just a password with a different name.
Seriously, what is the functional difference between this and stricter password requirements? I don’t see it.
Passkeys use a challenge/response protocol that doesn’t transmit any actual secrets. This makes them phishing resistant as you can’t just “type in your passkey secret” it gitnub .com
You’re supposed to have multiple devices (phone, tablet, laptop, desktop, etc) that all store your passkey securely (it can’t just be sitting on the SSD…). You’re also supposed to backup your passkey.
Yes, if you lose access to all your devices it could prove challenging to access GitHub… but that’s a pretty unlikely scenario and most people should be willing to pay the price (what self respecting programmer travels anywhere without two or three devices?)
You are also supposed to backup everything you have on GitHub elsewhere… so it shouldn’t be a total disaster if you lose access. It’d just be annoying. And presumably GitHub has some kind of recovery process for someone who’s lost access to an account? What if the repository maintainer dies? Someone else has to be able to take over.
On the other hand - if my bank required a passkey… then I’d probably switch banks. If all my stuff is stolen or destroyed, I still need access to my money. And if someone compromises my bank… well it’s just money. The stakes are far higher if a popular GitHub repository is compromised.
deleted by creator