Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

111–120 of 684 posts

Re: Passkeys are now enabled by default for Google users

#111

Post by PreInternet01 »

G: Here's a cool new security feature!

HN: Yeah, but what if disaster scenario?

A1: If you're authenticating to Google because your $DAYJOB mandates it, contact your Enterprise Administrator. As part of their multi-gazillion deal with the dark side, I'm sure there is some kind of support for a recovery mechanism, and if there isn't: yeah paid holiday until they figure it out!

A2: If you rely on Google for personal-slash-small-business reasons, please refer to the previous writing on the wall, and accept that all is probably lost...

Re: Passkeys are now enabled by default for Google users

#112

Post by ghaff »

di4na wrote: post #11
jjoonathan wrote: post #6

Ugh, is this why my FIDO key started making me enter a redundant pin on the company login page (so: enter password, press FIDO key, enter PIN, press FIDO key)?

Yes. That plus the way apple implemented it. In my case i was already on passkeys and google decided to just... forget them all on my other computers. I can't use them to get in anymore. Why? Who the heck knows. This whole passkey shit is going to be a nightmare for UX.

In general, the levels of security that people will increasingly need going forward, and the increasing requirement by companies to use that level of security, will be a usability pain for many people and a nightmare for at least a subset.

Re: Passkeys are now enabled by default for Google users

#113

Post by andrewstuart2 »

progbits wrote: post #52
TheRealPomax wrote: post #29

Earlier quoted context omitted.

also, "ah yes, a several digit pin, famously more secure than a same-length password that adds even as little as letters".

PIN for secure module with throttling and max wrong attempt count is indeed safer than a password you can brute force offline.

Brute forcing offline kinda only works if you have a stolen hash or artifact like that. For a service like Google, they definitely have rate limits on password attempts.

I'm not saying I prefer either one here, just that password authentication doesn't automatically mean you can brute force offline.

Re: Passkeys are now enabled by default for Google users

#114

Post by dilippkumar »

Hottake here:

The biggest mistake that the passkeys movement did is try to make it sound more marketable at the cost of oversimplification.

First up, these aren’t really “no password” mechanisms. They’re closer to ssh certificates. You need to authenticate through some other mechanism and then agree to do the equivalent of creating and installing ssh certificates on your device.

The ssh certificates get synchronized across your devices securely by your cloud provider. But they can never serve as the primary authentication mechanism - that will still have to be a traditional authentication mechanism.

It’s mildly infuriating that someone decided to take this simple idea and confuse the fuck out of everyone by positioning it as some alternative to a password based authentication mechanism. Obviously everyone is going to come and ask a ton of questions about how a mechanism without any passwords should work. And then the responses further confuse everyone because they don’t want to admit “no actually you still need passwords”

/rant

Re: Passkeys are now enabled by default for Google users

#115

Post by soco »

toomuchtodo wrote: post #105
grotorea wrote: post #53

Earlier quoted context omitted.

That does seem circular in Google's case, no? What cloud storage?

Google Password Manager. https://developers.google.com/identity/passkeys/supported-en...

Which I cannot access because I lost my passkey device.

Re: Passkeys are now enabled by default for Google users

#116

Post by konschubert »

frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

And what if somebody breaks into my google/iCloud account and syncs all my passkeys to their machines?

Re: Passkeys are now enabled by default for Google users

#117

Post by grotorea »

rmellow wrote: post #65

Simpson's Paradox lives here. On average, this might increase security (the vast majority of users are terrible at using passwords). For proficient users who use passwords securely, this is an acute drop in security (if forced to use). Forced phone number 2FA has the same effect; in Big G's case forcing phone number 2FA is anti-anonymity disguised as security. In this case, it's a bid for biometrics.

> For proficient users who use passwords securely, this is an acute drop in security (if forced to use).

Why? Because the user can have their device stolen and the PIN guessed? Can't you use a long password instead of a PIN if you want to?

And this part I'm not sure of, please correct me if you know. If I understand it correctly there's one security advantage even assuming a sophisticated user who is immune to weak passwords, password reuse or phishing. If there's ever a leak of Google passkeys, the leak would only get public keys, which can't be used for login, making the leak mostly useless.

Re: Passkeys are now enabled by default for Google users

#118

Post by kube-system »

tshaddox wrote: post #90
lopis wrote: post #44

Earlier quoted context omitted.

Ah right, account recovery. The one that tells me the only way to sign in to my old Google account is to use a phone that no longer exists.

What’s the standard then? Should it be possible to recover your account without possessing any evidence whatsoever that you are the person you say you are?

Other businesses have humans on staff which will verify your identity documents. Google simply chooses not to do this, because it is expensive, and their "users" are not their customers.

Re: Passkeys are now enabled by default for Google users

#119

Post by vdelitz »

TMWNN wrote: post #83

The post mentions eBay as a site using passkeys. eBay's implementation on PC accepts Touch ID, while Google's implementation did not the last time I tried it.

try this one: https://g.co/passkeys (you need to have set up a passkey before though)

Re: Passkeys are now enabled by default for Google users

#120

Post by chupaolo »

grotorea wrote: post #47
frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

> What is the account recovery process if I’m locked out and don’t have my phone, say it’s lost or broken and I can’t verify my identity? > You can always fall back to legacy authentication options such as passwords and traditional 2-step-verification. In a case where you can no longer remember your password, you can also go through Google’s Account recovery flow. We encourage you to add your email and phone number t…

Then what's the point of it all if a hacker can still get into my account using the traditional methods? This seems to be just opening up another avenue of attack.
Post reply on HN