Hacker News new | past | comments | ask | show | jobs | submit login

Which ones then? Using yubikey means enrolling multiple of them as backup which a lot of sites don't allow.

Other implementations are often blocked, eg on paypal I've never been able to do it and they also only allow one.

The big tech ones don't have these issues but I won't use them because I want to keep control.






> a lot of sites don't allow.

About the only site I've come across that still only limits a single authenticator is the only one you've already mentioned. If I pointed out a site that only allowed five character upper case passwords with no lockout policy and really fast responses is that also proof passwords are completely untenable? Or just one actor with poor policy decisions And in the end one can just choose to not use passkeys with sites like PayPal. But the extreme majority I've used allowed multiple, as that's what the specifications recommended.

In the end you can use passkeys without involving Google or Microsoft or Apple at all. Any argument that passkeys lock you into their platforms isn't based in reality and are repeating untruths. You don't need to use them to use passkeys.


Just gonna point out that AWS IAM only started allowing multiple 2fa devices 2 years ago.

https://aws.amazon.com/blogs/security/you-can-now-assign-mul...

It's entirely possible that many sites shared this flaw.


Correct, AWS was one of a small handful of services I was thinking about which did have this restriction but now haven't had that restriction for multiple years.

Well for me it's 50% as the only two sites that I use and do passkeys are Microsoft and PayPal.

Adoption is really slow. But yeah ok, if multiple are allowed then yes it's no longer a problem. I'm sure I read of more sites that had this problem but it is indeed possible they're fixed now.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: