Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That introduces new friction to setting up a new device, which is worse than the case with passwords.


You can use the same passkey for multiple devices (for example with keepassxc as authenticator that handles them), but it reduces security same as for example with using ssh private key that's not unique per device.


And if you don't use the same passkey, then you have to create more passkeys.


You should be able to revoke needed passkeys then. I.e. let's say you lost device A. May be revoke access for associated passkey for all places where you used it, but the rest of them would remain OK. Not sure how sites handle that (if at all).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: