alt Hacker NewsWith physical U2F key, I could explain to my 78 year-old-parents "this is a physical key needed to access your account. Think of it like the front door key to your house. Don't lose it or lend it to anyone. We should have a couple of backup keys too." And they got completely understood and added it to all of their accounts. This was not hard. People assumed consumers were too stupid to do this without even giving them a chance.
Replies
I never found a comfortable way to ensure all of my accounts had more than one U2F key associated with them. I always wished there was a way to have 2 physical U2F keys, one on me, and by adding one to an account, both would work.
As is, I had to either:
- Keep both on me, and add both - I am at risk of losing both at the same time
- Keep one one me, one in a safe - I have to keep track of which device I've added to which service, and periodically take the backup one out of the safe and iterate through the "new" services
I was never satisfied with either approach, so I ended up with an OTP app with backups.
And/or maybe the vendors were annoyed that people would lend the keys anyway, refusing to accept that it is normal because that's how delegation of authority works in real life too. House keys are also things you often lend to a third party that you want/need to access your house in your absence, and in fact making extra duplicated for trusted third parties is normal.
Software vendors continue to refuse to support, or even accept the existence of, this entire class of use cases for regular consumers (they are, however, more than happy to milk enterprises on convoluted implementations of those).
Sure, but i would never want a physical key to something important. Physical keys get lost, so the front door spare is under the flower pot.
And now I have another thing I need to carry everywhere.
I still can't even get a physical key anywhere in person. You can certainly get phones just about anywhere, but you can't get any FIDO keys at brick and mortar, last I checked.
Until I can tell Grandma to "go down to Walmart and ask the man at the electronics counter for a Yubikey", we still have a few issues.
(No. Ordering online is *not* a valid option in this scenario. If I want to order a Yubikey to this address at this exact moment in time and space, Amazon won't deliver one to me for at least six days at the earliest, based on their rural delivery estimate. Replacing a key is basically impossible.)
> Don't lose it or lend it to anyone. We should have a couple of backup keys too.
Honestly, this is one of the two things that make me hate passkeys. The key management is a high-friction pain in the ass.