<story><title>Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard</title><url>https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/</url></story><parent_chain><item><author>michaelt</author><text>Eh, retrieving a key from off-site storage every time you open a new account is a pretty big inconvenience, even for a security enthusiast.</text></item><item><author>vngzs</author><text>You just register 2-3 keys. It&amp;#x27;s not so bad.</text></item><item><author>throwaway52022</author><text>I&amp;#x27;ve resisted switching to a hardware key because I know that I&amp;#x27;m going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don&amp;#x27;t necessarily care that the key is generated on the device and never leaves the device. I don&amp;#x27;t care if that slightly reduces my security - I&amp;#x27;m not protecting nuclear weapons, my threat model is not state actors trying to attack me, my threat model is me leaving my key in my pants pocket before putting it in the washing machine.</text></item></parent_chain><comment><author>lxgr</author><text>That&amp;#x27;s exactly why FIDO [1] and WebAuthN [2] are moving towards a concept of backup-able&amp;#x2F;cross-device-sync-able authenticators.&lt;p&gt;That is arguably less secure in some contexts, but there are workarounds, and I do see the point that for most services, availability&amp;#x2F;key loss recovery is as much of a concern as is security.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;multi-device-fido-credentials&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;multi-device-fido-credentials&amp;#x2F;&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;w3c&amp;#x2F;webauthn&amp;#x2F;issues&amp;#x2F;1714&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;w3c&amp;#x2F;webauthn&amp;#x2F;issues&amp;#x2F;1714&lt;/a&gt;</text></comment>
<story><title>Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard</title><url>https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/</url></story><parent_chain><item><author>michaelt</author><text>Eh, retrieving a key from off-site storage every time you open a new account is a pretty big inconvenience, even for a security enthusiast.</text></item><item><author>vngzs</author><text>You just register 2-3 keys. It&amp;#x27;s not so bad.</text></item><item><author>throwaway52022</author><text>I&amp;#x27;ve resisted switching to a hardware key because I know that I&amp;#x27;m going to break it, and that seems like a huge pain in the ass. I really want to be able to make a couple of backup keys, or maybe put another way, I want to be able to put the private key on the device myself, I don&amp;#x27;t necessarily care that the key is generated on the device and never leaves the device. I don&amp;#x27;t care if that slightly reduces my security - I&amp;#x27;m not protecting nuclear weapons, my threat model is not state actors trying to attack me, my threat model is me leaving my key in my pants pocket before putting it in the washing machine.</text></item></parent_chain><comment><author>vngzs</author><text>Right. Some core services get this treatment, like email and important online accounts. For others I rely on reset mechanisms tied to those email accounts if I lose the primary key and haven&amp;#x27;t had the chance to register the secondary. Every few months I&amp;#x27;ll sync up anything that has been missed.&lt;p&gt;It&amp;#x27;s not perfect, but it&amp;#x27;s a hell of a lot better than TOTP.</text></comment>