It’s not quite unique to a specific device. You can store your private key in a password manager or something similar, and then access it from other devices
Comment on Google will now make passkeys the default for personal accounts
alvvayson@lemmy.world 1 year ago
It’s definitely more secure, since stealing someone’s phone is much more difficult to scale up compared to stealing passwords.
ada@lemmy.blahaj.zone 1 year ago
alvvayson@lemmy.world 1 year ago
Depends on your personal choice. You can definitely limit them to a single, hardeneddevice if you want the highest level of security.
For most users and most situations, a synced solution will be preferable.
V0lD@lemmy.world 1 year ago
But it becomes much easier if you want to compromise a specific target individual
alvvayson@lemmy.world 1 year ago
No, not really.
Even if you want to target a specific user, it doesn’t become necessarily easier.
Unless you happen to target an individual that combines good password OpSec with shitty phone OpSec.
But I would expect those to be a minority.
V0lD@lemmy.world 1 year ago
Hi, yes, I am that minority
I have a 37 character password with both cases, numbers and special characters to login to my pw vault using long random strings
My phone has a swipe pattern lock since that is the safest lock option it allows in the first place. I wish I could lock it better, but the only other options available to me are a 4 character pin, and fingerprints/facial scan. I hope the problems with those are obvious
Couple that with the fact that I have a daily predictable commute in public transit where I have a habit to put my phone next to me during breakfast and you have a recipe for disaster.
greybeard@lemmy.one 1 year ago
Finger prints on Android stop working after 24 hours, a reboot, and some other cercumstances. I feel pretty OK using fingerprint to unlock my phone, because in about 99% of cases I might be compelled to unlock my phone, I will either be able to restart it first, or that 24 hour timer will have expired.
alvvayson@lemmy.world 1 year ago
You can still use a 37 character password to protect your passkeys in your pw vault, so it’s not like anyone is forcing you to change.
It’s still a single factor though. The number of times I have had to lecture IT admins that their 64 character passwords was compromised by a keylogger and that they need to move towards MFA is too damn high.
As for your phone, if that’s sufficient for you, go for it.
There are better phones out there.
wreckedcarzz@lemmy.world 1 year ago
Me, at the bank:
Robbers, as they enter the bank: everybody freeze
Me: ah shit
Robbers: everyone give me your phones
Me: aw hell naw
mission impossible style shootout
Engywuck@lemm.ee 1 year ago
I don’t think that access to your personal data/email/files being dependent on a battery-powered electronic device is a great idea, to be honest.
alvvayson@lemmy.world 1 year ago
That’s why they invented chargers, eh.
But more seriously, there are recovery procedures if you lose a phone with or without a backup and if you are willing to share the keys with a cloud provider, you can also store them there and use them on any of your devices.
Or you can get something like a yubikey if the battery aspect is really that problematic for you.
Engywuck@lemm.ee 1 year ago
The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.
alvvayson@lemmy.world 1 year ago
Bitwarden is also supporting passkeys, so it won’t make a difference for their users whether they use passwords or passkeys.
And the fact that you don’t see anything wrong is more a you problem. Boomer mentality, dude. Don’t became one.
confusedbytheBasics@lemmy.world 1 year ago
Long passwords can still be phished. Passkeys cannot. It’s a huge upgrade.
AA5B@lemmy.world 1 year ago
My understanding of Apple Keychain is that every credential is useable from every device, and can be backed up and restored to a new device. Most importantly Apple doesn’t have access, although we have to trust them on that