Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

31–40 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#31

Post by barkerja »

dtech wrote: post #6

It looks like a good change for the average user, a secret stored on the device is likely a whole lot safer than just having a password. Having it as the only factor seems less secure than password + good extra factor like TOTP on device though. I also wonder how a lost/broken/replaced device is dealth with, especially given Google's less-than-stellar account lockout history. edit : I guess this is still MFA since yo…

Passkeys can also be used in addition to passwords, as a form of 2FA. I've seen a number of sites approach Passkeys in this manner.

Or if you really wanted to, you could flip it. You can allow the Passkey to be the "password" and an actual password the second-factor for the user.

Re: Passkeys: The beginning of the end of the password

#32

Post by ExoticPearTree »

The advantages are very poorly explained in the article.

Last time I read about this, you could use your phone or a FIDO key to authenticate. Like if the phone was close to the computer you could aithenticate the same way you can unlock your computer with your watch.

So either this new technology is so advanced lesser minds don’t understand it or it jus adds a more cumbersome authentication method instead of passwords and its adoption rate will be in single digits.

Re: Passkeys: The beginning of the end of the password

#33

Post by barkerja »

nashashmi wrote: post #14

So yahoo has had this for a while. yes ... Yahoo. What's wrong with Google these days? They seem to be too focused. BTW, passkey is the name for a password that is made using word keys.

Google has actually had this rolled out for some time. I've been using a Passkey on my account for the better part of a year. For whatever reason, they're just now announcing it.

Re: Passkeys: The beginning of the end of the password

#34

Post by neilalexander »

XorNot wrote: post #4

I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are asleep at the wheel as it's happening. They want to tie you to an external service, so they can tie you to your phone, which they also manage with another external service. All of these schemes are braindead with obtuse, user-unfriendly backup/transfer/restore…

Nothing about this is tied to phones or external services. You could just use a hardware authenticator (like a YubiKey) as a device-bound passkey if that is what you prefer.

Re: Passkeys: The beginning of the end of the password

#35

Post by echeese »

zug_zug wrote: post #20

What are the privacy implications for this? Are companies that see my passkey going to be able to link it to all my other accounts, or will each passkey be completely anonymous?

Passkeys are unique per Relying Party, in this case, google.com can only access passkeys for google.com. They can't even enumerate them, all they can do is pop up a dialog and wait for the user to select one.

Re: Passkeys: The beginning of the end of the password

#37

Post by kps »

barkerja wrote: post #25
vlovich123 wrote: post #10

Earlier quoted context omitted.

Sure. But am I still locking my ability to access that account permanently to Google? Can I login via Chrome on an Apple/Windows platform and add a passkey there? I’m also a bit worried that this permanently entrenches these as the platform vendors because no one is going to port to a new platform unless you’re already a major tech company (maybe).

Google actually outlines that very scenario near the bottom of their announcement: > Using passkeys does not mean that you have to use your phone every time you sign in. If you use multiple devices, e.g. a laptop, a PC or a tablet, you can create a passkey for each one. In addition, some platforms securely back your passkeys up and sync them to other devices you own. For example, if you create a passkey on your iPhon…

> If you want to sign in on a new device for the first time, or temporarily use someone else's device, you can use a passkey stored on your phone to do so.

No lock-in; you have two phone OS vendors to choose from!

Re: Passkeys: The beginning of the end of the password

#38

Post by gst »

Just a heads-up if you're planning to use passkeys with iOS/macOS: Might be fixed already, but last time I tried it out it seemed like iOS only stored a single passkey per domain. If you first store a passkey for a@domain and then later on store a passkey for a different user b@domain the a@domain passkey is overwritten without any warning. Or at least this seemed to be the case a couple of months ago when I tried it out.

Re: Passkeys: The beginning of the end of the password

#39

Post by [deleted] »

bsenftner wrote: post #24
XorNot wrote: post #4

I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are asleep at the wheel as it's happening. They want to tie you to an external service, so they can tie you to your phone, which they also manage with another external service. All of these schemes are braindead with obtuse, user-unfriendly backup/transfer/restore…

[flagged]

[deleted]

Re: Passkeys: The beginning of the end of the password

#40

Post by wepple »

dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

Password + password manager can be trivially phished. PIN can’t, because even if you somehow phished a user you can’t use it.

I don’t know what “proper 2FA” means but the gold standard today is U2F, and it has failed to be mass adopted due to requirement to purchase and maintain another device.

Post reply on HN