Bringing passkeys to Android and Chrome

Post by pastage » Wed, Oct 12, 2022, 7:24 PM UTC

throw10920 wrote: post #79

Someone1234 wrote: post #69

Earlier quoted context omitted.

The second most popular top level comment chain is: > Unless I can back it up and import it into a new device from a competitor, then there is no way I am going to use this unless forced. I do not trust one company anymore. Which is the same sentiment as this thread. The first comment was just talking about the open standard of Apple's implementation and weakness of 2FA loss/recovery. https://news.ycombinator.com/ite…

Yup - GP made the mistake of treating HN as a single person with a coherent opinion. It's not, and it's extremely tiring and intellectually uninteresting to repeatedly see people doing that.

Post by saulrh » Wed, Oct 12, 2022, 7:25 PM UTC

josteink wrote: post #104

saulrh wrote: post #101

Earlier quoted context omitted.

Bitwarden will do TOTP, and its CLI tool is quite usable. If you want it fully local, just stand up a docker of their server software (which is open source) or the open source reimplementation (vaultwarden).

> Bitwarden will do TOTP Not disputing this, but it requires a “pro” account which is $10 a year. No big deal to me, in fact I find it a great deal, but I think it’s fair to be clear about this as not to provide false expectations.

Post by [deleted] » Wed, Oct 12, 2022, 7:32 PM UTC

mooreds wrote: post #76

wnevets wrote: post #27

Passkeys sound like another way for companies like Google and Apple to lock you into their walled garden. Having each walled garden randomly generating a key for every single domain instead of using the actual domain name as part of the key is a great way to lock regular people into their respective ecosystems.

My understanding of passkeys is that they are using WebAuthn under the hood (hence the nod to the w3c/FIDO at the end, and the fact that the passkey in the screenshot was associated with tribank.us). They are solving a very real problem. WebAuthn uses private keys, but those private keys are tied to the device where they were created. This is a blessing and a curse. It's a blessing because it eliminates a whole trove…

Post by duskwuff » Wed, Oct 12, 2022, 7:37 PM UTC

linsomniac wrote: post #110

quadrifoliate wrote: post #75

Earlier quoted context omitted.

It's not particularly surprising. Apple has a much better reputation at customer service than Google does – they have actual stores you can walk into. Now I'm not sure whether they can help you unlock your Apple ID if you prove to them that you're the owner of the account, but I can at least visualize Apple having the scale to do that. Google on the other hand has a horrendous reputation for locking out people out of…

Apple, on the other hand, has terrible problems with working with others that google does not. Apple will happily tell you that if you want grandma to have a whatever color text bubble, you should buy her an iPhone, to name a recent example, rather than adopt the standard everyone else is using. I bought a Macbook last holiday season and couldn't even set it up until my wife set up her iPhone on my account to activat…

Post by joshuamorton » Wed, Oct 12, 2022, 7:48 PM UTC

politelemon wrote: post #109

joshuamorton wrote: post #85

Earlier quoted context omitted.

Be precise: what threat is added here that is added by a third party holding encrypted keys? Like this isn't particularly different from me backing up my (encrypted) disk which contains my (further encrypted) keys to the cloud somewhere.

In the second instance, you are controlling the where and how of your keys being backed up. If you are smart you will have backed up your keys to multiple locations, for disaster recovery. One of the fundamentals of privacy is having control of your data, which the first option does not provide.