Hacker News new | ask | show | jobs
by lolsowrong 1146 days ago
Google’s implementation allows multiple passkeys. I have a passkey for my iPhone, one from Windows Hello, and 3 from different yubikeys I’ve picked up over the years. The yubikey implementation requires setting a PIN, so I’m not even really worried about one of them being lost of stolen.
1 comments
wg0 1146 days ago
Cloud you please elaborate in detail how someone not using Yubi keys should adopt it by having hardware keys and how much keys should one have?

How Keys are different than an OTP app like Authy?

link
themagician 1146 days ago
The Apple security model for Apple ID and iCloud already works like this. Every device is effectively a “passkey” even if they don’t call it that. Been that way for a while now.

Every device (except accessories like AppleTV, HomePod, etc.) you log into iCloud with effectively has Super Admin control over your entire iCloud account. Any logged-in device can remove, modify, or change (almost) anything without a password… including the account password (hence the almost). Once authorized, that access is controlled by biometrics with a backup PIN. As long as you maintain control of a single device you have access to everything.

Yubikeys work the same way. Doubly so when dealing with resident credentials and passkeys. Key as as many as possible—just make sure the PIN is not obvious. If you hold the key and know the PIN, you can do anything. No other information is needed.

The big difference between this and OTP is two fold: 1) much more resistant against phishing; and 2) the underlying key is less likely (or impossible-ish) to be exposed. Phishing a 2FA OTP is actually not hard with a good fake UI. It just requires someone to act quickly on the other end or a good script that can quickly change the password/security settings once a password and OTP are successfully phished.

link