71–80 of 684 posts
Isn't it obvious that logging in with your face or your fingerprint is less secure? Sure, it's convenient, but any thug can just forcefully unlock your device.
In case od data leak - you cannot change your face, or fingerprints. You can change passwords though.
Please don’t insert commentary when it’s clear you don’t know what you’re talking about
Earlier quoted context omitted.
You go through.... account recovery? Like if you lose your password today?
If you can recover an account without the passkey, how much security is it really adding?
But it seems in this case the account recovery is just using the password so the passkey is mostly convenience and maybe Google trying to move things away from passwords more than a complete change.
Probably a stupid question but why can't photos of my face be used to defeat this?
The biometrics aren't authenticating you. They only unlock your phone, which stores the private key used to authenticate you.
Isn't it obvious that logging in with your face or your fingerprint is less secure? Sure, it's convenient, but any thug can just forcefully unlock your device.
I think for anyone not working in national security, any thug could just as easily get your password out of you.
Everybody has a limit. I spent some time in interrogation... once.
They make it hard on you ? - They don't make it easy.
Yeah, it was unpleasant. I held out as long as I could.
All the stuff they tried. You just can't hold out for ever.
How'd they finally get to you?
They gave me a grasshopper. - What's a grasshopper?
That's two part gin, two part brandy, one part crème de menthe...
As usual, the multi-device/multi-OS and recovery scenarios are simply just glossed over. I'll stick with a password vault I can sync to multiple OSes, thanks.
I had read some good things about YubiKey, but I don't think I could get it to work on my corporate computerr.
Earlier quoted context omitted.
The biometrics aren't authenticating you. They only unlock your phone, which stores the private key used to authenticate you.
I see. So really this is public/private key authentication and the face/pin/fingerprint etc is just the typical device unlock stuff.
Earlier quoted context omitted.
It isn't, and this isn't authentication with a pin. Passkeys also requires the device. Using a pin with this is 2-factor. Pin + hardware token.
So why not just have a password that then unlocks the passkey? I already have a password manager.
Earlier quoted context omitted.
If you can recover an account without the passkey, how much security is it really adding?
It at least avoids the user being phished or being compromised by reusing passwords. But it seems in this case the account recovery is just using the password so the passkey is mostly convenience and maybe Google trying to move things away from passwords more than a complete change.
Google wants to be a gateway to everything else you do.
The next step is to get other platforms to accept Google passwordless auth.