artlu's Bear Blog

Secrets, Security and Fragility

Got new iPhone. Transferred all data using standard process.

Banking app needs re-authentication. It doesn't use passkeys (yet).

Modern fintech app uses passkeys (only!), sign in is trivial.

Some apps copy data from their servers with a valid login (LINE, TG). Some only do so after you scan QR code on old phone (WeChat). WhatsApp requires a long phrase.

Crypto wallets that use the phone's Secure Element load your wallets in Watch-Only mode. You'll need to extract the secrets from the old phone, perhaps save them to iCloud, and re-import them to the new phone. If you ever lose the old phone at the bottom of a lake, that wallet is fully gonzo.

My own wallet does encryption-at-rest and wire encryption. The encrypted secrets are stored in PWA storage, and everything got copied over automagically, including the ability to decrypt them. If you ever drop the phone in the ocean, that wallet can be recreated without much trouble.

I set up one FaceID scan. If I ever get new glasses, maybe I'll lose access...