Hacker News new | past | comments | ask | show | jobs | submit login

I can't speak for OP, but for every service that I use passkeys with I enrolled both iCloud Passkeys (for convenience) and several YubiKeys (for portability and backup).

This is not different at all from a SSH public/private key combo. You are not supposed to duplicate SSH keys!




Your answer is totally reasonable, but I admit I don't have time for that in most cases.

1. Most services are not Passkey-only--most people are using it as a password alternative (e.g. eBay) or a second-factor alternative. So losing it won't lock me out.

2. A very small number (e.g. Google) let you configure Passkey as your sole second factor. For those, I am indeed careful to do what you do and have duplicates.

I do think this is kind of bad? So the grandparent totally has a point here: services find it hard to do only Passkeys (and thus realize the security benefits).

But, as a user, it's not something I worry about a lot, to be honest.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: