Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

341–350 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#341

Post by clnq »

skybrian wrote: post #209
signal11 wrote: post #161

Earlier quoted context omitted.

My cynical assessment of Passkeys is: If Google/Amazon/Apple/Meta/whoever locks your account out, you now lose access everywhere. This isn’t a theoretical risk. You’ll see lots of people complain about this online. Also, Passkey providers now get sweet sweet metadata about your accounts around the web. But yeah, authn is hard to do right. Equally, asking your users to fall into $BIG_PROVIDER’s arms seems wrong. My pe…

I don’t know about privacy, but the lockout risk doesn’t seem worse than losing your phone or Yubikey. You should have multiple independent ways to log in for any account you care about. Passkey will be one way. Possibly two ways, if you have both Android and iOS devices and you register both? (I assume Android and iOS remain independent.)

What if one loses all their devices in a natural disaster, a house fire, or burglary, or lost baggage while traveling?

A password is in your head. If you lose that, there's not much use for the said password. But otherwise, it's secure. And it's pretty secure from an infosec perspective if it's a passphrase.

Re: Passkeys: The beginning of the end of the password

#342

Post by jjav »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

> Until they develop a way to explain what passkeys really are, I question how quickly they will be adopted.

The article is very frustrating, very long on fluff and no substance.

If anyone has a link to a detailed technical description by an unbiased third-party (not google hawking their lock-in), I'd be very thankful if it can be posted.

Re: Passkeys: The beginning of the end of the password

#343

Post by clnq »

lxgr wrote: post #158
alberth wrote: post #145

Dumb questions: 1. what's the backup login mechanism when you lose your mobile device? 2. with Passkeys enabled/used, will this stop google from randomly locking my account because I happen to be a person who travels a lot and they constantly think I'm a fraudster attempting to log into my own account. 3a. can I use my google passkey for logging into non-Google sites? 3b. can I use my google passkey (biometric) to lo…

> 1. what's the backup login mechanism when you lose your mobile device? Passkeys are synced to the cloud by default on iOS and Android, which is probably a good idea for many use cases, but might not be what you want in some instances. > will this stop google from randomly locking my account because I happen to be a person who travels a lot and they constantly think I'm a fraudster attempting to log into my own acco…

> Passkeys are synced to the cloud by default on iOS and Android, which is probably a good idea for many use cases, but might not be what you want in some instances.

Okay, but Google is suggesting logging into their account with a passkey, so how do I access the cloud if I lose the devices with my Google passkey?

Re: Passkeys: The beginning of the end of the password

#344

Post by angry_octet »

lxgr wrote: post #163
Gasp0de wrote: post #94

There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally. Theoretically, passkeys could still offer this advantage if they are stored…

Passkeys are an authentication mechanism, and as such replace (authentication) passwords, not (encryption) passphrases. A password (at least as I understand the term) is used to authenticate to some third-party entity to get access to your data or services. The (implied or legal) contract here is: "Only give access to my data to anybody that can provide my password." Government authorities can in most cases just go t…

This is incorrect because you’re conflating access by request and access with a court order. Without a warrant, or even probable cause, police can get some meta data, but not everything in the cloud. In many places police can force you to use biometrics to unlock devices, but not compel a passphrase. (Passphrases are significantly harder for e.g. Greykey to glitch brute force than PINs.)

Re: Passkeys: The beginning of the end of the password

#345

Post by NikolaNovak »

Ignorant question:

Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"?

If I am in some kind of calamity (dropped my phone, got robbed, etc), and I come to a friendly person's house, it sounds to me like I simply would not be able to login to potentially critical services, no matter how much I know, because I don't have anything (the device that passkeys are tied to / on).

Is that true?

And... am I the only person completely dreading this system?

I don't live on my one and only phone; I have two phones, 3-4 tablets, 4-5 computers I use regularly. Of various operating systems, browsers, manufacturers, etc.

I can create a password of arbitrary complexity and security and comfortably use all my devices as well as any new device that comes my way.

Passkeys sound... like a nightmare?

(they also sound AMAZING to my wife and family... woohoo no passwords, I just have to use my phone... until they INEVITABLY lose or break their phone... and then they'll come to me and I have no idea what to tell them anymore -- all your passkeys were on your device and now they're gone forever because Google & Apple decided it was better for you, and you did not follow obscure methods I frankly cannot help or explain to you to maybe possibly back them up, one day, when method exists, to some other device)

Re: Passkeys: The beginning of the end of the password

#346

Post by blackhaz »

rdsnsca wrote: post #202
segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

Apple, Google and Microsoft are all supporting passkeys https://developer.apple.com/passkeys/ https://arstechnica.com/information-technology/2022/10/passk...

class ASAuthorizationSecurityKeyPublicKeyCredentialAssertionRequest

Now I'm wondering what's the longest class name out there...

Re: Passkeys: The beginning of the end of the password

#347

Post by jjav »

bhk wrote: post #246
dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

Being tied to a device, it defeats the most serious threats of phishing and weak passwords, for which attacks can be mounted on a global scale. 2FA via SMS is still vulnerable. 2FA with an app like Google Authenticator or VIPAccess is more secure because it is tied to a device.

> more secure because it is tied to a device

Tied to a phone (as opposed to some security-specific device like a Yubikey) is a terrible idea.

It ties your authentication to something that is often lost or damages, but more importantly, something that is controlled by a third party (apple or google) and requires an expensive monthly subscription to yet another third party (your cellphone company).

TOTP is not tied to a device which is why it's a beautiful solution. You can store it where you wish under the controls you wish and back it up as you wish. You are fully in control, dependent on nobody.

Re: Passkeys: The beginning of the end of the password

#348

Post by jamilton »

waboremo wrote: post #282
r00fus wrote: post #222

Earlier quoted context omitted.

> What I don't like bout Google doing this is that the big providers use this to tether and lock you in to their platform. This is not what they want. They want to a) ensure passwords/accounts aren't being shared to ensure a single account is tied to a single user. They want this for all apps so they can recognize revenue for every user. b) They want more information on you as a user (as opposed to your family member…

Can you explain how passkeys explicitly reaches that end goal, when all of that is already currently possible without passkeys?

You can share passwords easily, I don't think you can trivially share passkeys.

Re: Passkeys: The beginning of the end of the password

#349

Post by account-5 »

Nope, passwords stay until passkeys aren't tied to a device that can be lost, stolen, or broken. Or you need multiple devices to avoid that. And they are offline and not controlled by multinational corps only interested in monitoring everything you do for profit.

Re: Passkeys: The beginning of the end of the password

#350

Post by bobsoap »

Ok, Google. I'll bite.

So you send me an email today titled "[Update] Google passkey support will replace your built-in security key starting May 3, 2023". It was in my spam folder, but I digress.

This "update" kindly informs me that "Passkey support will be integrated because they're easier to use" [sic], that it's safer than most other forms of 2-SV, that this new method will work on any devices that have registered passkeys, which includes all phones on which I'm signed in, that I'll be able to sign in to my Google account with just a passkey, that no action is required from me to do this, and that you're here to help.

Yes, Google, I'd like some help. For starters, I'd like to know:

- What do you mean by "built-in security key"? Built-in suggests hardware, so my phone presumably has a hardware security chip and now passkey is a new type of hardware chip for authentication?

- What's 2-SV? Two Sievert? Dos El Salvador? Double Support Vector? Second Silicon Valley?

- What the heck is a passkey?

Luckily, you provide a link to your HC article [1], which I click on. It's titled "Sign in with a passkey instead of a password". It helpfully informs me that with a passkey, I can sign in to my Google account with my fingerprint/face scan/device screen lock like a PIN. There's a bunch of other valuable information in that article, like how it won't work in Firefox, won't work in incognito mode, that Bluetooth must be enabled, and that anyone who manages to unlock my device gets full access to my account. Needless to say, sounds totally awesome, I'm sold!!1

What the heck is a passkey?

Is it like the thing that sometimes uses my Android phone as a 2FA device to sign into Google properties, just... somehow different? What's the difference, except that I now need to enable Bluetooth and can't use it in Firefox? How is it more secure than [something I know + something I own] if it removes [something I know] from the equation and only leaves me with one of the two factors? How is it more secure than Dos El Salvador?

Who the heck wrote this email?

[1] https://support.google.com/accounts/answer/13548313

Post reply on HN