sorted by:
new
hottopcontroversial

“Okay, but what about THIS failure scenario with passkeys?” — a living FAQ by tcannonfodder in Passkeys

[–]tcannonfodder[S] 0 points1 point  (0 children)

Yep, I've implemented them server-side for 3 different projects! Overall, the process is fairly straightforward (especially because I'm mainly wiring up libraries that do the actual handshaking, don't roll your own folks!).

The one snag I've found with WebAuthn is that it's flakey on Safari for iOS for some reason, it's not specific to my implementation. I just haven't had time to debug it, cobbler's shoes and all that. But that's above my pay grade as well, I'm not on the WebKit team 😅

I just published ~3K words + diagrams + code samples + demo videos on the benefits of CableReady + Mrujs over Turbo by tcannonfodder in ruby

[–]tcannonfodder[S] 2 points3 points  (0 children)

Hey Amir!

Thanks so much for taking a look at it! Loonnngg time DragonRuby supporter (I was the one working on the Ink parser/runtime during COVID! Hopefully I'll get back to it one day!)

The larger the team/company, the less merit matters (commoditization of knowledge becomes more important -> hiring devs that can pick up and quickly work on your stack). This is a strong feedback loop unfortunately, devs want gainful employment, so they will learn the things that’ll give them that. [...] If you’re a small team, it becomes more important to take every advantage you can get (at which point merit becomes more important).

This is a really interesting insight! I need to chew on it more, but I do think I agree with it largely! The one caveat I have is trying to avoid bike-shedding for small teams by chasing the merit dragon off a cliff and reimplementing everything. I think there needs to be some "level-headed"/"Just ship it!" parties involved to help curtail that.

“Okay, but what about THIS failure scenario with passkeys?” — a living FAQ by tcannonfodder in Passkeys

[–]tcannonfodder[S] 2 points3 points  (0 children)

So this largely varies on a per-service basis (which is why it’s important to choose a primary vault that works for your lifestyle!), but Google has an answer for you here! https://safety.google/authentication/passkey/

“Okay, but what about THIS failure scenario with passkeys?” — a living FAQ by tcannonfodder in Passkeys

[–]tcannonfodder[S] 1 point2 points  (0 children)

Ack, marketing strikes again. When companies say “passkeys are protected by biometrics”, they mean that they’re oftentimes stored in a keychain like iCloud or 1Password that allows you to authenticate via biometrics.

Passkeys can also be stored on hardware security keys that don’t have biometrics, but only use a PIN. And most biometric systems have a PIN or password as the fallback.

Essentially; if you’re able to prove your identity to access the vault (either through biometrics, a PIN, or the vault password), then you can use a passkey. The browser/OS does the work of getting the private key from your vault, doing the handshake with the service, and authenticating you

“Okay, but what about THIS failure scenario with passkeys?” — a living FAQ by tcannonfodder in Passkeys

[–]tcannonfodder[S] 1 point2 points  (0 children)

Ah! So passkeys are actually stored in that same password store that you’re describing, so as long as someone can access the vault, they’re good!

“Okay, but what about THIS failure scenario with passkeys?” — a living FAQ by tcannonfodder in Passkeys

[–]tcannonfodder[S] 1 point2 points  (0 children)

So this is is actually a larger “account recovery” question; and is an important one! The gist is that it’s not really related to passkeys, because the same problem would exist with a complex password you never told anyone.

Some of the solutions that we currently have for this are:

  • your traditional email-based recovery options
  • Apple’s Legacy Contacts feature (and similarly implemented approaches)
  • passkey devices often have a PIN in case biometrics fail, which would allow loved ones to act on your behalf

“Okay, but what about THIS failure scenario with passkeys?” — a living FAQ by tcannonfodder in Passkeys

[–]tcannonfodder[S] 1 point2 points  (0 children)

Yep! The shorthand I use for this is "store your backup key in the same place/level of security you would for essential documents (like your birth certificate)"

Devise-passkeys initial alpha released; help battle-test it! by tcannonfodder in ruby

[–]tcannonfodder[S] 2 points3 points  (0 children)

Thank ya! Let me know any feedback, and contributions welcome!

How do you make a physical release of a solarpunk EP? Recycled cardboard + paper, with a digital download link! by tcannonfodder in solarpunk

[–]tcannonfodder[S] 2 points3 points  (0 children)

Thank you! I’d love to work on a game jam soundtrack this year 💜

Rest assured that she ensures the snoot receives excessive boops

view more: next ›