Tech

Why does losing my phone mean choosing between lockout and SMS fallback?

الفرصة

Passkeys eliminate passwords but introduce a fragility the FIDO2 spec does not solve: account recovery. If you lose your only enrolled device and have not pre-configured vendor-specific sync, you are locked out or forced back to SMS OTP, which re-opens the SIM-swap attacks passkeys were supposed to close. Apple, Google, and Microsoft each built incompatible sync silos, so moving from iOS to Android means re-enrolling at every service by hand. The WebAuthn spec defines how to create and use credentials but explicitly defers recovery to each platform. No vendor-neutral, cryptographically sound recovery primitive exists that preserves the original threat model.

لماذا تهم

Recovery is the weakest link in the passwordless stack, and solving it is the last mile that makes passkeys a viable replacement for passwords at scale.

كيف أقيّم الفرصة

نقاط الفرصة هي قراءتي الشخصية لا قياس دقيق: مدى تأثير المشكلة، وتكرار مواجهتها، وشُح الحلول المتاحة لها اليوم. كلما ارتفعت النقاط، كان البناء في رأيي أجدر بالاهتمام.

الحدّة8/10

مقدار الألم الذي تسببه حين تظهر.

التكرار7/10

مدى تكرار مواجهة الناس لها فعلياً.

الفراغ السوقي8/10

مدى شُح الأدوات الجيدة المتاحة لها اليوم.