Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

291–300 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#291

Post by Ajedi32 »

awaythrow98765 wrote: post #276
Ajedi32 wrote: post #111

Earlier quoted context omitted.

> Now one could allow backups of a passkey That's literally part of what makes a passkey a passkey (v.s. just a WebAuthn credential), so that's a given. > as insecure as a password No. Passkeys can't be phished, passwords can. Passkeys can't be cracked after a data breach. Passwords can. Passkeys can't be set to something easily guessable. Passwords can. Passkeys can't be written on a post-it note and taped to your m…

> No. Passkeys can't be phished, passwords can. Passkeys can't be cracked after a data breach. Passwords can. Passkeys can't be set to something easily guessable. Passwords can. Passkeys can't be written on a post-it note and taped to your monitor. Passwords can. Passkeys can't be reused across multiple sites. Passwords can. Passkeys don't need to be cracked after a data breach of your backup provider, they are just…

You seem to be under the false impression that passkey databases are stored completely unencrypted and unprotected on disk or in the cloud. Obviously those details are implementation-dependent, but I don't know of any passkey implementation that works that way.

Let's take Apple's implementation as an example (since that was the one I could most easily find information on). Their implementation stores passkeys in the iCloud keychain[1], which is end-to-end encrypted[2].

[1]: https://support.apple.com/guide/iphone/sign-in-with-passkeys...

[2]: https://support.apple.com/guide/security/secure-keychain-syn...

Re: Passkeys: The beginning of the end of the password

#292

Post by arunc »

bwanab wrote: post #157

And once again, with a Google Workspace (or whatever they call it these days) account, "Passkeys aren’t allowed on this account. Contact your admin for help". I am the admin. Doesn't appear there's any way to help.

It seems like passkey isn't available for Google Workspace yet. (I'm a Google Workspace admin as well).

Re: Passkeys: The beginning of the end of the password

#293

Post by hunter2_ »

Came to HN today figuring there would be a thread about this, after getting an email about it from Google themselves, riddled with things causing me to wonder if the message was spoofed:

1. "Dear User" -- other emails I've gotten from Google say "Hello" or "Hi " or have no salutation at all.

2. The main section begins with "Passkey support will be integrated because they’re easier to use, and safer than most other forms of 2-SV." -- The plural antecedent of "they're" is merely implied (the literal plural antecedent "passkeys" isn't actually written).

3. In that same sentence, the comma before "and" is grammatically incorrect. The comma should not exist, or it should be followed by a complete sentence. The same comma rule is also violated in a later sentence: "You won’t need to enter a password to sign in to your account, or to select only a single phone to use as your built-in security key any longer."

I'm not really a huge stickler for grammar, but I've seen countless "how to spot phishing" guides specifically suggesting that we look for grammatical mistakes, as they're specifically included for purposes of improving the ratio of hooked phish to eaten phish, so it follows that messages which aren't phishing really ought to use correct grammar!

Re: Passkeys: The beginning of the end of the password

#294

Post by jimmar »

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are.

Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or retina. What are hardware tokens? They are physical devices that give you codes that verify that the person logging in has the device on their person.

What are passkeys?

Until they develop a way to explain what passkeys really are, I question how quickly they will be adopted.

Re: Passkeys: The beginning of the end of the password

#295

Post by falcolas »

seti0Cha wrote: post #233
falcolas wrote: post #187

Earlier quoted context omitted.

> that doesn't imply I might as well share the same password across all my accounts Irrelevant to the argument I made. My argument already assumes you're using unique passwords, since it's made quite simple these days.

My example appears to have distracted you from the point I was making. Let me make the point again without an example: being vulnerable to one attack does not mean there's no value in not being vulnerable to another attack when the attacks require different strategies and levels of effort. Or again: making breeching security more difficult does in fact reduce your risk of random security breeches. Or to put it anothe…

Changing out passwords for passkeys does not improve security in anything but a theoretical manner.

Good passwords (stored on the backend with a password-optimized hash) are pretty close to bulletproof, and all browsers that I've used in the last few years prompt you with very good passwords.

Again, the key is that people who would use passkeys are the same ones who will be using good, non-reused passwords in the first case. We've taught non-technical users too well that they should not pay attention to out-of-browser prompts, so they're not going to be able to use passkeys without significant and broad re-training.

Re: Passkeys: The beginning of the end of the password

#296

Post by JohnFen »

nilsbunger wrote: post #226
pcthrowaway wrote: post #205

Earlier quoted context omitted.

Biometrics are shitty usernames too. They might change, it's just outside of your control. My apple touchID never works because I rock climb and I guess that abrades the skin too much

i rowed on a crew team for many years. The pads of my fingers were all worn down. I was rejected three times for "bad fingerprints" when applying for US citizenship.

It's not as rare as people think for fingerprints to be messed up either permanently or temporarily. Which amazes me, actually, because I'll be willing to be pretty near 100% of adults have, at least once in their lives, burned or otherwise injured their fingers in a way that alters their prints.

Relying on fingerprints to gain access to things on a regular basis never seemed like a great idea to me.

Re: Passkeys: The beginning of the end of the password

#297

Post by JustSomeNobody »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

Thank you. I've been trying to figure out what they hell they are and have been unsuccessful. I thought it was just me.

Re: Passkeys: The beginning of the end of the password

#298

Post by JohnFen »

oli-g wrote: post #51
VoodooJuJu wrote: post #19

Earlier quoted context omitted.

>with a fingerprint, a face scan or a screen lock PIN I agree - not secure. And just a daily reminder that biometrics are usernames , they are not passwords. You can change a password, a lock, a key, you cannot change biometrics, and thus they should not be used for guarding sensitive info. The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate su…

> biometrics are usernames, they are not passwords While I see where you're coming from, they really aren't just usernames. It's not like I can log into your e-mail account by typing VoodooJuJu and pressing Enter.

But most biometrics (at least faces and fingerprints) make terrible passwords. They can be copied and they're very hard to change if you need to.
Post reply on HN