Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

11–20 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#11

Post by ferminaut »

dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

it's more secure on the back end. The DB will store a hashed unique pass phrase that isnt shared with anyone else.

You enter a pin, the web server sees a public key that only your side has the private key to.

Re: Passkeys: The beginning of the end of the password

#13

Post by tallanvor »

baryphonic wrote: post #8

I don't want to give Google my fingerprint or my face. A password in a password manager + 2FA is fine.

You're not. You're storing a private key on a device, and using something like a fingerprint or pin to unlock it and use it to authenticate. The fingerprint data is also only stored on the local device.

Re: Passkeys: The beginning of the end of the password

#15

Post by surteen »

dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

Because it's a PIN protecting a certificate stored on the device. Even if you know the PIN but don't have access to the device, you can't use it.

Re: Passkeys: The beginning of the end of the password

#16

Post by toomuchtodo »

surteen wrote: post #15
dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

Because it's a PIN protecting a certificate stored on the device. Even if you know the PIN but don't have access to the device, you can't use it.

And the pin is the same functionality as activating a hardware authenticator like a Yubikey.

Re: Passkeys: The beginning of the end of the password

#17

Post by toomuchtodo »

TheChaplain wrote: post #9

And if you have your google account banned/disabled for whatever reason, then what?

Passkeys should still be on your local device. Account recovery should fall back to e-mail magic link or government credential proofing (depending on data sensitivity and threat model).

(manages customer IAM for a FinTech)

Re: Passkeys: The beginning of the end of the password

#19

Post by VoodooJuJu »

dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

>with a fingerprint, a face scan or a screen lock PIN

I agree - not secure.

And just a daily reminder that biometrics are usernames, they are not passwords. You can change a password, a lock, a key, you cannot change biometrics, and thus they should not be used for guarding sensitive info.

The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance.

Post reply on HN