121–130 of 684 posts
Earlier quoted context omitted.
Passkeys are stored within your device, iPhone, Android, browser, or system keychain. https://passkeys.directory/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco... https://support.apple.com/en-us/102195
What if you use an old-fashioned desktop PC?
Never. You can pry my passwords from my cold, dead hands.
“But it’s safe in the Google/Apple/Microsoft cloud” is not an acceptable answer.
Nope, not signing up. The trend from Google continues to be towards "if you lose your phone with your credentials, you will be unable to log in". And Google refuses to create a scalable system that allows you access to your account by verifying your identity in person. This is a recipe for disaster. And, possibly, a warning to move off GMail before it gets worse.
Is it possible to control the credentials in your phone and copy them somewhere else?
Simpson's Paradox lives here. On average, this might increase security (the vast majority of users are terrible at using passwords). For proficient users who use passwords securely, this is an acute drop in security (if forced to use). Forced phone number 2FA has the same effect; in Big G's case forcing phone number 2FA is anti-anonymity disguised as security. In this case, it's a bid for biometrics.
> Forced phone number 2FA has the same effect; in Big G's case forcing phone number 2FA is anti-anonymity disguised as security. It can actually be both; in fact it very likely needs to be: 1. Phone numbers are the best long-term identity most people have 2. Google has billions of users and needs to support account recovery at unbelievable scale 3. Many people lose passwords and devices, but very few lose phone numbe…
But it would be even more secure if there was an opt-in "I don't want to use my phone as 2FA".
Phone number authentication creates a weakness for anyone who is in a targeted attack.
A motivated attacker can easily bribe/trick a telecom employee, or if physically accessible, swipe the phone itself to read 2FA texts.
Earlier quoted context omitted.
It isn't, and this isn't authentication with a pin. Passkeys also requires the device. Using a pin with this is 2-factor. Pin + hardware token.
So why not just have a password that then unlocks the passkey? I already have a password manager.
Password managers are not relevant, as you don't use a password manager to unlock your phone.
The people behind the takeover don't really give a shit about Yubikey-style tokens (which haven't achieved much market penetration anyway) but they've left them in to make the takeover less blatent.
For example, it is completely valid to say I genuinely do not know my 1000 long multiple special character password; it could be on a piece of paper, in a file encrypted with multiple layers. Essentially, there is no foolproof way to ever prove whether I know a given password, or not, especially if the password is only ever in my head (assuming the plaintext version is never logged, all you would ever have as 'proof' is a hash to compare it to).
Passkeys make it so that, I imagine, there is an element of 'proof' at all times; your face, fingerprints (which in some countries you are required by law to provide), I can't disprove I "own" my fingers so that element is always there, and you can be compelled to provide your fingerprints at any time for any reason - with a password, it is impossible to know whether I know a password.
In that sense, a password is far, far, far stronger than any other method of authentication.
Take a scenario: Mr Police wants access to your phone, it's protected only by your fingerprint, pretty easy to gain access. Now do the same but with a password that's sufficiently complex, written on a now shredded piece of paper, and there is genuine plausible deniability.
I imagine in a lot of cases this is extremely important and passkeys will be shunned altogether.
As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?
As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?
And what if somebody breaks into my google/iCloud account and syncs all my passkeys to their machines?
You can try to recover by revoking all your passkeys and starting over with hardware tokens, but that's likely what a sophisticated attacker is going to try as well, and they're probably faster than you.
Still way way better than passwords.
Correct me if I'm wrong but isn't it fair to say that passkeys secured on your phone are more secure than 1FA (password) but less secure than "traditional" 2FA? Passkey 2FA: unlock your phone and the passkey on your phone can log you in. Traditional 2FA: remember a password AND unlock your phone (where your TOTP is stored) and you can login If I were to rate all 3 methods on a scale of 1 to 10, for convenience and se…