You can follow the steps here to use a previous version of the desktop app to extract the keys: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93
The javascript didn't seem to send the extracted data anywhere, but I did disconnect from the internet while running the script.
Errm...
Remote wipes are possible. Log into your Apple/Google account, figure out how to find your device, then perform a remote wipe.
I was looking through this community because my daughter was recently diagnosed, but this comment hit a nerve.
I cannot stand socks that feel wrong, and no, I cannot explain what exactly "wrong" means. I don't own more than 1 identical pair of socks: each pair has a clear left and right sock, so mixing up 2 identical pairs is a nightmare.
That's the part where the server doesn't story any information that an attacker could use to log in. The attacker would need the private key, which is stored inside a secure chip on your device (unless you decide to store it in your password manager). All that's stored server side, is the public key.
When you're using a password, the server will store a hashed version of that password. If this is leaked, an attacker can attempt to brute-force this leaked password. If the server didn't properly store hash the password, a leak simply exposes the password and allows the attacker access. If the user didn't generate unique passwords for each site/server, that exposes them further to password spraying. In that case an attacker would try these same credentials on multiple sites, potentially giving them access to all these accounts.
In case of passkey, the public key doesn't need to be secret. The secret part is all on your end (unless you store that secret in the managed vault of your password manager).
I do agree that your risk is quite small if you're already
The biggest difference: nothing sensitive is stored on the server. No passwords, no password hashes, just a public key. No amount of brute forcing, dictionary attacks or rainbow tables can help an attacker log in with a public key.
"But what about phising? If the attacker has the public key, they can pretend to be the actual site and trick the user into logging in." Only if they also manage to use the same domain name. Like a password manager, passkeys are stored for a specific domain name. If the domain doesn't match, the passkey won't be found.
https://www.youtube.com/watch?v=qNy_Q9fth-4 gives a pretty good introduction on them.
More practical: the main version is on my desktop PC. That one gets synced automatically to my NAS. This NAS makes a nightly incremental backup to a cloud provider.
Once you have a setup like this, maintaining it is peanuts. Pay the bills on time and setup email alerts to let you know if drives are going bad or you're reaching your storage limits.
You do need to ensure you're testing your recovery plans once in a while. A backup is worthless if you can't restore it
It gets worse: it's extremely addictive. Research has shown that habitual users who want to detox die within 48 hours unless they start consuming it again.
Not sure what part you don't understand, but I'll try and help: Snopes (a fact checking website) shows that the way links are displayed nowadays (the new link presentation or new way links are presented) on X (formerly Twitter) lacks any sense -> snopes shows the folly of it.
Unless you have siblings. Then you're the less successful evolutionary branch that died out.
As a manager in software engineering: this! If I learned that one of my devs was wasting time like this, I'd want to know. Just make sure to stick to the facts.