• @[email protected]
    link
    fedilink
    English
    262 months ago

    Passkeys are also weirdly complex for the end user too, you can’t just share passkey between your devices like you can with a password, there’s very little to no documentation about what you do if you lose access to the passkeys too.

    • @bandwidthcrisis
      link
      English
      132 months ago

      I think that passkeys are simple, but no-one explains what they do and don’t do in specific terms.

      Someone compared it to generating private/public key pairs on each device you set up, which helps me a bit, but I recently set up a passkey on a new laptop when offered and it seemed to replace the option to use my phone as a passkey for the same site (which had worked), and was asking me to scan a QR code with my phone to set it up again.

      So I don’t know what went on behind the scenes there at all.

      • @ultranaut
        link
        English
        12 months ago

        The passkey on your phone stopped working when you set one up on your laptop? I would expect the site to allow one per device instead of one per account.

        • @bandwidthcrisis
          link
          English
          32 months ago

          It seemed that way, it asked me to scan a QR code on my phone to link it, which didn’t happen before.

          Or maybe the option to use my phone was some older auth method, where I’d use the fingerprint reader on the phone to confirm a login on the laptop. I thought that was a passkey, but that doesn’t fit with what I’m reading about what it does now.

        • @jj4211
          link
          English
          12 months ago

          Some sites only allow one public key per account…

          • @Spotlight7573
            link
            English
            12 months ago

            Which is really stupid of them but technically within spec currently.

    • @vzq
      link
      English
      13
      edit-2
      2 months ago

      you can’t just share passkey between your devices like you can with a password

      Either you enroll a system that shares them between devices without the need for special interaction (password manager, iCloud etc) or you enroll each device separately into your account.

      You can have more than one passkey for a service. This is a good thing.

    • @cmhe
      link
      English
      102 months ago

      The only way I ever used passkeys is with bitwarden, and there you are sharing them between all bitwarden clients.

      From my very limited experience, pass key allows to login faster and more reliable compared to letting bitwarden enter passwords and 2fa keys into the forms, but I still have the password and 2fa key stored in bitwarden as a backup in case passkey breaks.

      To me, hardware tokens or passkeys are not there to replace passwords, but to offer a faster and more convenient login alternative. I do not want to rely on specific hardware (hardware token, mobile phone, etc.), because those can get stolen or lost.

      • @[email protected]
        link
        fedilink
        English
        2
        edit-2
        2 months ago

        Interesting, maybe I’ll give it a try. I didn’t know they could just be synced between devices on bitwarden.

      • @[email protected]
        link
        fedilink
        English
        12 months ago

        +1 for Bitwarden. Seamless experience so far. EBay hasn’t yet worked properly, but GitHub does for sure. It’s very convenient, especially if your browser doesn’t store cookies

    • @Spotlight7573
      link
      English
      12 months ago

      you can’t just share passkey between your devices like you can with a password

      You would just sign into your password manager or browser on both devices and have access to them?

      Additionally, whatever app or service you’re storing them in can provide sharing features, like how Apple allows you to share them with groups or via AirDrop.

      there’s very little to no documentation about what you do if you lose access to the passkeys too.

      If you lose your password, there are recovery options available on almost all accounts. Nothing about passkeys means the normal account recovery processes no longer apply.

      • @[email protected]
        link
        fedilink
        English
        22 months ago

        You would just sign into your password manager or browser on both devices and have access to them?

        Does it work like that? Everything I see says they’re tied to that device.

        If you lose your password, there are recovery options available on almost all accounts.

        Fair, I guess I’ve never lost a password because it’s just a text string in my PW manager, not some auth process that can fail if things don’t work just right.

        • @Spotlight7573
          link
          English
          32 months ago

          Does it work like that? Everything I see says they’re tied to that device.

          It depends on what kind you want to use. If you want the most security, you can store them on something like a Yubikey, with it only being on that device and not exportable. If you get a new device, you’ll need to add that new device to your accounts. For less security but more convenience, you can have them stored in a password manager that can be synced to some service (self-hosted or in the cloud) or has a database file that can be copied.

          Fair, I guess I’ve never lost a password because it’s just a text string in my PW manager, not some auth process that can fail if things don’t work just right.

          That’s fair. It can be a bit of a mess with different browser, OS, and password manager support and their interactions but it has continued to get better as there is more adoption and development.

          • @[email protected]
            link
            fedilink
            English
            12 months ago

            I’m excited to see where it is in another year or so, the idea of using public/private keys for logins is neat for sure.

    • @linearchaos
      link
      English
      12 months ago

      Any of the multi-platform password managers that support pass keys will solve this.

      You walk into the vault on every platform and your pass keys are magically shared between every platform you’re logged into.

      In any system that I’ve used pass keys for (which is every system that supports them), you can go into the password section and delete devices/passkeys.

      To regenerate new passkeys they either support it directly in the spot where you deleted it or you log out log back in with username password and 2FA and it asks you again if you want to set up a passkey. I’ve not run into anything else.