491–500 of 1001 posts
I wish they gave the option to disable this.
There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally. Theoretically, passkeys could still offer this advantage if they are stored…
> In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). Which countries? In the US, the intersection between 5th amendment rights and password disclosure is not complete. You can be forced to disclose a password in certain circumstances here.
Earlier quoted context omitted.
Why not call it a private key then, we've been handling those since the 70's. They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.
It isn't (just) a private key. It is part of a purpose-built authentication process that leverages private keys as a component. You cannot use the private key within a passkey for general purpose data signing, for example.
Earlier quoted context omitted.
It’s a password that Google controls so when they incorrectly ban you from their services you lose access to literally everything. Or if you drop your phone in a lake you’re out of luck too.
It's the second one, not the first one. The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth. (Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone…
I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…
Cool idea about the NFC ring. Is there anything like that now? Any application?
There are payment rings a plenty though, for just using them instead of contactless credit cards.
Earlier quoted context omitted.
It's the second one, not the first one. The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth. (Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone…
Unless there is proof that the hardware on the phone is isolated specifically for this task you cannot make the claim that google is unable to MITM.
Just here to note that there are several huge problems with this approach from an actual security standpoint: First is that this changes from 2-factor authentication (something you have plus something you know) to single-factor (just something you have). Also be sure to notice in the article that they have changed their term there to 2-STEP authentication, not 2-FACTOR authentication, these are not the same thing, an…
Ignorant question: Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? If I am in some kind of calamity (dropped my phone, got robbed, etc), and I come to a friendly person's house, it sounds to me like I simply would not be able to login to potentially critical services, no matter how much I know , because I don't have anything (the device that…
I like to explain it like this: If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Passkeys is a formalization of the idea that you should be using a password manager where all the passwords are random uncrackable 32 character strings, and if we add…
Which is precisely why I would never use an offline only password manager. In the case outlined above, I would need to connect to my online password manager, using the master password I have in my head; which then would allow me to connect to all my services.
How would that work with passkeys ? So far the only way I could see this working is if every single device on earth comes with a fingerprint/face scanner. Because my face and my fingers will always be there for me (hopefully). Otherwise we are back to secrets (aka: passwords).
Earlier quoted context omitted.
Banning has nothing to do with it. You use passkeys as a preferred login method. If you do not have your passkey, you can tap "Try Another Way" and use your password as usual.
This means that you still need a password, which you still should store securely. It just becomes much harder to phish out this password.
If you've also lost access to your email, you've got other problems.