I still don't understand how the QR code flow works with using/creating passkeys on other devices. It seems it uses a bluetooth connection to your phone, but I can't find much documentation about the exact protocol
Passkeys: The beginning of the end of the password
91–100 of 1001 posts
Re: Passkeys: The beginning of the end of the password
#92What are the legal implications of passkeys? Are there any case law examples yet?
My understanding is it's 100% impossible to 'prove' I know a password or not as it could be written on a piece of paper somewhere, and it's entirely possible for that paper to be shredded and therefore any proof of that password is gone, forever. I remember hearing you cannot be compelled to hand over a password.
Biometrics et al on the other hand? Could/would a judge compel those to be disclosed? I saw a video of a police officer forcing somebody to use their face to unlock their phone to delete a video. With a password, this would be 100% impossible.
So yeah, think about that BEFORE using.
Re: Passkeys: The beginning of the end of the password
#93I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are asleep at the wheel as it's happening. They want to tie you to an external service, so they can tie you to your phone, which they also manage with another external service. All of these schemes are braindead with obtuse, user-unfriendly backup/transfer/restore…
[flagged]
To avoid being a propagandized lemming you have to have a basic understanding of what is happening...
passkeys aren't tied to Google or to any other specific provider. Note that this announcement is just about Google supporting logging to with passkeys to their platform. But you don't have to have anything to do with Google to use passkeys with other sites/apps that support them.
Re: Passkeys: The beginning of the end of the password
#94There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally.
Theoretically, passkeys could still offer this advantage if they are stored exclusively on my phone which is encrypted and secured with a password.
Re: Passkeys: The beginning of the end of the password
#95Earlier quoted context omitted.
The point of passkeys isn’t to be perfect — the point is to replace passwords, which are already far more imperfect than passkeys. The bonus points with a password is that every site that uses them has to secure them properly and theft of passwords, in plain-text, hashed, etc form is common.
Imagine for a moment that instead of all the time wasted on this, we just implemented a protocol amongst the browser makers which allowed a secure password prompt to be requested, and required strong-hashing before sending anything over the wire? Which would be easier to use and more effective.
If you hash before sending anything over the wire then the hash of your password is now your password, meaning that if it leaks it amounts to basically the same as your password leaking. Granted, applications may choose different hashing algorithms, provide their own clientside salts, etc. which would be really nice. To be fair, I believe more systems should be doing this nowadays, it's really weird to have to send your actual password to the website if a hash would suffice. Then the website could store the salted hash of the salted hash of your password in their database.
Programs such as Bitwarden already do this, where you send the hash of your password to the server instead of the password itself, because from the password you derive the decryption key and you never want that reaching the server. You then use that hashed password as the authorization password, but the client uses the actual password to decrypt the delivered password vault.
Re: Passkeys: The beginning of the end of the password
#96I was expecting this also meant that I could add a FIDO2 resident key as a passkey, but the google UI currently does not allow me to do that. That's fairly disappointing.
Its also fairly surprising that desktop UI on linux tells me I can't add passkeys from it. I understand that Chrome isn't planning on supporting platform authenticators on linux, but why can't I add another phone from the desktop with the QR flow?
Re: Passkeys: The beginning of the end of the password
#97Earlier quoted context omitted.
At least for the Google account, it looks like you can add multiple passkeys.
Sure. But am I still locking my ability to access that account permanently to Google? Can I login via Chrome on an Apple/Windows platform and add a passkey there? I’m also a bit worried that this permanently entrenches these as the platform vendors because no one is going to port to a new platform unless you’re already a major tech company (maybe).
You are confusing the location where passkeys are stored (your Android, your iPhone, your Yubikey) and where they can be used (to access your Gmail account).
Re: Passkeys: The beginning of the end of the password
#98I enabled passkey and literally nothing changed. Signed out and back in again several times.
Re: Passkeys: The beginning of the end of the password
#99Earlier quoted context omitted.
This is what I love about passwords. They are tangable and understandable. I would have loved if we could move towards a solution that has the benefits of passkeys (prevents phishing, strong secret, doesn't seen the secret to the server) without ditching the underlying secret being a somewhat human-readable password. It seems that in-browser password-managers get us 99% of the way there. I would have loved to do some…
Also tangible and understandable is a registry of users who have access to your accounts, that allows you to grant and revoke access (at possibly different levels), without having to reset all your own credentials. I've got to quit commenting, but humans are undeniably the weakest link in security. While I understand the perceptions and even share some of the concerns expressed in this thread about the loss of contro…
> It's a few extra steps up front, but once it's working, it's so much easier.
It's a few extra steps per site. Every time you get a new device you need to go back to every site you've ever visited and update the credentials. It is maybe feasible for a few important accounts but it doesn't scale.
Whatever solution we have needs to be syncable and able to be exported to a safe once and continue to be usable by new sites and devices into the future. People aren't going to print out their credential list every month to update the fire safe.
Re: Passkeys: The beginning of the end of the password
#100How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.
A PIN entered onto a physical device like a smartphone can be rate limited (see iPhone progressively increasing PIN timeouts). If you try to rate limit password entry to an online service, you make it trivially easy for an attacker to lock out a real user.
Thus, even short PINs can provide strong security since the attacker gets, e.g., at most 10 tries to guess it out of 100k possibilities for a 6-digit PIN.