logoalt Hacker News

j16sdiztoday at 1:42 AM1 replyview on HN

From account security POV, it is better to disallow backup or export passkeys. Each device should get their unique key.

This would be quite bad from usability or privacy pov, I guess.


Replies

nixpulvistoday at 3:12 AM

It's ao comically bad it proves the while thing is a joke unless you're trusting Apple or Google to sync and back them up for you. One cynical angle at why the backup is being slow-rolled is because the major players have an incentive to not do it. They want you dependent on them and locked into their ecosystem.

It's completely insane to treat a credential to an account as something that cannot be backed up. It implies there's another form of recovery, which likely means that key is only as secure as the other recovery options. And when it comes all the way back to the master key to your manager itself the loop falls somewhat apart.

It's a hard problem, but passkeys aren't ready for me yet.

show 1 reply