Elektrine lite

← Feed

@fifonetworks@infosec.exchange

Post #2923276

2025-11-07 21:56 UTC

@rmondello@hachyderm.io Ricky, that was an excellent talk. I'm glad I watched it. I'm one of those people who still has serious reservations about adopting passkeys, and I was hoping you'd provide new information that changed my mind. My main reservation centers around the huge number of people who only have one device. If their only device breaks, and If they deleted the password authentication option, Then they experience permanent account lockout. I help people globally with tech support, including account recovery. I have a “no fix, no charge” guarantee. I’ve seen this problem first-hand. One device, broken or stolen, and accounts from Microsoft, Google, Apple, are gone forever. You asked in your talk for collaboration and input, so here’s my recommendation: any adoption of passkeys, any implementation of passkeys, needs to include “error checking” that prevents a user from ever having only one way into an account.

Replies (1)

  • @nsa@hachyderm.io 2025-11-08 02:39

    @fifonetworks@infosec.exchange @rmondello@hachyderm.io sites can look at the backup eligibility bit on the response to see if the credential syncs. In practice, it's mostly Windows Hello that produces credentials that don't sync. If the user has a single non syncing cred I'd make sure e.g. email recovery still works for them.

    Open ##2923277