Passkeys: Lost Device Recovery & Multi‑Device Sync
Key Points
- Passkeys store a private key on your device that you unlock with biometrics, eliminating passwords while maintaining security.
- If you lose the device, you lose the private key, but account‑recovery mechanisms similar to password reset (e.g., secret questions or identity verification) can restore access.
- You can securely synchronize passkeys across multiple devices (phone, laptop, tablet) via encrypted, authenticated cloud storage if you choose to enable it.
- While synchronization is optional, using a personal device is recommended; logging in on public or untrusted terminals is unsafe because malware could capture your credentials.
- Overall, passkeys aim to improve both security and usability, but they still rely on established recovery processes and user‑controlled device security.
Full Transcript
# Passkeys: Lost Device Recovery & Multi‑Device Sync **Source:** [https://www.youtube.com/watch?v=9nrE4t4-IXA](https://www.youtube.com/watch?v=9nrE4t4-IXA) **Duration:** 00:11:06 ## Summary - Passkeys store a private key on your device that you unlock with biometrics, eliminating passwords while maintaining security. - If you lose the device, you lose the private key, but account‑recovery mechanisms similar to password reset (e.g., secret questions or identity verification) can restore access. - You can securely synchronize passkeys across multiple devices (phone, laptop, tablet) via encrypted, authenticated cloud storage if you choose to enable it. - While synchronization is optional, using a personal device is recommended; logging in on public or untrusted terminals is unsafe because malware could capture your credentials. - Overall, passkeys aim to improve both security and usability, but they still rely on established recovery processes and user‑controlled device security. ## Sections - [00:00:00](https://www.youtube.com/watch?v=9nrE4t4-IXA&t=0s) **Handling Lost Passkey Devices** - The speaker explains that losing a device containing a passkey is essentially the same as losing a password, and recovery depends on standard account recovery methods such as biometrics and security questions. ## Full Transcript
there's a way that you can get better
security and better usability and get
rid of your passwords I did a video on
this in fact recently and there were a
lot of questions and I'm going to
address those questions the number one
question in particular about what
happens if I lose my device I'm going to
cover that and four others in this video
so the first one what if I lose my
device well it turns out the way pass
Keys work in this phto standard that I
talked about in the video is that you
keep a private key on your device and
you unlock that and access that through
a biometric like your face or your
finger or something like that so it
stays there that was the idea if you
lose the device then you lose that that
private key the secret that you need
however there are ways I'll ask you if
you lose your password today how do you
recover that in fact most websites have
an ability to do account recovery of
some sort or another you can either go
back back into the site and answer a set
of secret questions and yes most of the
time they're lousy they don't have to be
there could be good secret questions the
credit bureaus have been doing that for
years where they base it on information
they know about you already as opposed
to you choosing answers to trivial
things like your mother's maiden name so
there are ways to do that so what
happens if you lose your device it's the
same thing in essence as what happens if
I lose my password it's not a a
dramatically different kind of case we
have account recovery capabilities
related to this also then so that's the
first one related is what if I have
multiple devices I want to log in from
so I'd like to be able to log in not
only from my phone but from my laptop
from my tablet and this sort of thing
well what do you do in that case well
there's also the ability to synchronize
so in the video I talked about that you
would keep the private key on the device
and you can however if you want to there
are secure synchronization
capabilities where you put this in a
cloud and therefore all of your systems
let's say your phone your tablet your
your laptop and they all synchronize up
to a cloud and therefore that private
key is shared across all of these in a
secure way how is it done in a secure
way well you can go into the details of
how that happens but these these
sessions are authenticated and they're
encrypted as well so that way you can
actually use this
across multiple devices if you choose to
enable that that's not something that's
required but if you're concerned about
this you do in fact have an option also
sometimes related to this people will
ask well what if I want to go do this on
a public terminal uh at a friend's house
something like that I'm just going to
say my personal opinion is don't if you
don't control the system that you're
logging into and you don't control its
security you should assume everything
you type on it is public information
why because there could be malware on
that system that copies every single
keystroke that you make and then sends
that off to a bad guy and you say but I
trust my friend I'm using their system
it's not about trusting your friend it's
about trusting that the security on
their system is good so if you don't
control the security assume everything
you type on that system is generally
available to the world so I'm going to
say that's a bad idea in general but
here we've answered if the device is
lost and if I have multiple devices
another question that came up a lot was
this business about isn't this really
just SSH uh the secure shell or pgp or
TLS or SSL or any of those kind of
things well I'm going to say uh it's
it's not just it's a particular
application of some underlying
technologies that are in there for
instance is an electric vehicle just an
electric motor no we could use an
electric motor to be a fan we could use
it to to be a closeth washer we could
use it to be in a particular application
as an electric vehicle what we're
talking about underneath all of this is
pki public key infrastructure so in that
sense what I described is not new pki
has been around for a long time and
these standards have been around for a
long time however what they tend to do
is different so for instance if we're
looking at something like SSH we've got
a user here and a web server that
they're trying to log into or more
likely uh it's it's any kind of server
that they need to log into so what SSH
is really concerned with is creating a
secure connection a secure pipe this is
a VPN type technology so in other words
the emphasis here is on
confidentiality it's on data privacy is
another way to look at it now if we look
at something like pho which is the
standard I talked about to replace
passwords with pass Keys now we're
looking at something different now we're
just looking at a way for this user to
log into this website and give them a
key they give that information and
that's how they get logged into it now
they're not actually sending their
private key they're sending a pass key
so they keep the information that's
sensitive on their system it's never
exchanged so there we go uh We've
dressed the first three of these now
let's take a look at a few more some
people say really what's the problem
with password I like my passwords I'm
just going to stick with those well
what's the problem with passwords I'm
going to tell you it's people because
what will people do if you ask them to
follow the rules for passwords and the
rules that we generally ask them to
follow are that we want the password to
be complex that is so that it can't be
easily guessed we want the password to
be unique that is we want it to be uh
different across every different system
because if I figure figure out what your
password is on one system I don't want
to be able to have that so that they can
get into every one of the systems and we
want them fresh that is changing
constantly because someone might be able
to crack a password if given enough time
so if you take all of these things and
ask these humans to actually do that
what will they do I'll tell you what
they do they come up with exactly one
password to every single system they
violate this one and they usually
violate one by picking something that
they can easily remember which makes it
therefore easy to guess and they're not
so wild about changing these all the
time so in fact they end up not
following all any of these rules most
people that's what happens so understand
at the end of this system there's always
a human and what the human does and
their behavior matters so that's one of
the big problems with passwords right
off the bat and that's people now some
other people say oh but don't you know
about password managers these things are
really great and they are in fact I've
been using password managers for more
than 20 years and I think they are great
um but let's talk about what are some of
the issues that could happen here I'm
going to suggest to you so if we have a
a password manager so this is Will
depict this as holding a bunch of
different passwords we have a user here
and the user then goes and retrieves a
password from the password manager and
that's locked either by a biometric or
through a very strong password we hope
and then they send that off to all the
different sites that they need to log
into so that's the general flow the way
a password manager works that's great
however guess what what if this is not
the real website that we think it is
what if this is a fished website that is
this guy's been tricked into sending his
password to a place that it's not
supposed to be then this password once
it's on the bad guys system can be
reused and again if they have not chosen
good passwords it could get them into a
lot of different systems there are other
ways that this could be a breach so one
of those breaches as I said is a fishing
attack where the credentials are fished
another is a password database breach on
this side of the equation so what do I
mean by that over here these websites
maintain a database of hashed passwords
in other words it's a one-way encryption
of your password if someone gets into
this and takes those passwords offline
they may be able to crack those and come
out with what is the actual password if
given enough time and if they're able to
attack it here then that password can be
reused and again in a lot of cases the
people will have the same passwords
across multiples of these systems I'm
going to suggest to you as long as a
password exists it's vulnerable so in
other words a better system and this is
the way phto does it is the secret is
not sent the secret stays on your device
with the exception of these kinds of of
use cases that I mentioned where you
might synchronize it across devices but
during the authentication flow the
secret stays on your device in the case
of a password the secret goes across the
internet and is stored somewhere else so
now there's another copy of it therefore
the attack surface just got larger so
I'm going to suggest to you it's much
better if you have a system or the
secret stays on the device the pass key
is not the private key the pass key is
something that is time bound a password
is not a password can be reused again
and again and again a pass key cannot so
again we've reduced the attack surface
with a phto pass key and by the way in
in the end of all of this it's really
not about pho versus password managers
in fact most of the good password
managers support Pho already today in
addition to passwords so you have your
choice and I would just say when you get
a choice choose pass keys this literally
happened to me yesterday I was logging
into a major pharmaceutical website in
order to get a vaccination scheduled and
it said would you like to switch to
using pass keys and I said absolutely I
would like to because that way I keep
the secret on my device and I can still
get to these other systems and do it in
a much more secure much more able way
and it gave me a choice of using my
password manager or using the
capabilities built in my operating
system over 250 organizations are
members of The phto Alliance so you're
going to see this start rolling out more
and more don't be scared off B pass Keys
they're a better alternative the dog ate
my password somebody said well if that
dog is Pho as in the phto alliance
that's a good
thing thanks for watching if you found
this video interesting and would like to
learn more about cyber security please
remember to hit like And subscribe to
this
channel