YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.
> lack of backups if a device is lost/broken
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
You don't need to ask permission to buy another key then register it to your self-hosted service.
In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.
Liftyee · · focus · HN ↗
utopiah · · focus · HN ↗
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
account42 · · focus · HN ↗
utopiah · · focus · HN ↗
In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.