Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

141–150 of 684 posts

Re: Passkeys are now enabled by default for Google users

#141

Post by vdelitz »

orev wrote: post #130
JaneLovesDotNet wrote: post #109

Correct me if I'm wrong but isn't it fair to say that passkeys secured on your phone are more secure than 1FA (password) but less secure than "traditional" 2FA? Passkey 2FA: unlock your phone and the passkey on your phone can log you in. Traditional 2FA: remember a password AND unlock your phone (where your TOTP is stored) and you can login If I were to rate all 3 methods on a scale of 1 to 10, for convenience and se…

Nobody should be using a remembered password anymore. Most people are likely using the phone for both the password and the MFA code.

Agree

Re: Passkeys are now enabled by default for Google users

#142

Post by shinycode »

tshaddox wrote: post #90
lopis wrote: post #44

Earlier quoted context omitted.

Ah right, account recovery. The one that tells me the only way to sign in to my old Google account is to use a phone that no longer exists.

What’s the standard then? Should it be possible to recover your account without possessing any evidence whatsoever that you are the person you say you are?

If you travel in an other country and loose your phone or the phone gets stolen. How can you log into Gmail from anything else if you need access to travel or anything else ? Like receiving a confirmation of identity by email from the bank or another service ?

Re: Passkeys are now enabled by default for Google users

#143

Post by konschubert »

px43 wrote: post #129
konschubert wrote: post #116

Earlier quoted context omitted.

And what if somebody breaks into my google/iCloud account and syncs all my passkeys to their machines?

If they're in your Google/iCloud, you're already in a game over scenario. The point of all this is to prevent that from happening. You can try to recover by revoking all your passkeys and starting over with hardware tokens, but that's likely what a sophisticated attacker is going to try as well, and they're probably faster than you. Still way way better than passwords.

If they break into my iCloud then they’re in my iCloud. They’re not in all my other accounts, because I use an encrypted password manager that isn’t iCloud.

Re: Passkeys are now enabled by default for Google users

#144

Post by JaneLovesDotNet »

orev wrote: post #130
JaneLovesDotNet wrote: post #109

Correct me if I'm wrong but isn't it fair to say that passkeys secured on your phone are more secure than 1FA (password) but less secure than "traditional" 2FA? Passkey 2FA: unlock your phone and the passkey on your phone can log you in. Traditional 2FA: remember a password AND unlock your phone (where your TOTP is stored) and you can login If I were to rate all 3 methods on a scale of 1 to 10, for convenience and se…

Nobody should be using a remembered password anymore. Most people are likely using the phone for both the password and the MFA code.

Right, in which case passkeys would be equally secure. But if you DO memorize the password (for example for your most sensitive account), then it feels like traditional 2FA is more secure.

That being said passkeys win if you also take convenience into account. I've updated my original comment with convenience scores to reflect that.

Re: Passkeys are now enabled by default for Google users

#146

Post by px43 »

csjh wrote: post #24
netsec_burn wrote: post #17

This is an interesting direction. It's worth noting that biometrics, like fingerprints or facial recognition, aren't really 'secrets'. They can be observed or leveraged without a users knowledge or consent, and in many ways function more like a username than a password.

Don't they need both physical access to device + fingerprints/face?

Yes.

Re: Passkeys are now enabled by default for Google users

#147

Post by renegat0x0 »

ezfe wrote: post #71
renegat0x0 wrote: post #25

Earlier quoted context omitted.

In case od data leak - you cannot change your face, or fingerprints. You can change passwords though.

Good news that you can’t bring someone’s face to google and ask for access to their account… Please don’t insert commentary when it’s clear you don’t know what you’re talking about

Thieves can steal a car using tech magic. That is also true about access to accounts. That contradicts your comment. Biometrics, if stolen, can be used to access any of accounts if one obtains knowledge about how to use it for hacking.

Your comment violates HN guidelines, but as guideline says I assume good faith therefore I have provided details about how you're incorrect on that one.

Re: Passkeys are now enabled by default for Google users

#148

Post by konschubert »

ngrilly wrote: post #132
konschubert wrote: post #116

Earlier quoted context omitted.

And what if somebody breaks into my google/iCloud account and syncs all my passkeys to their machines?

The passkeys are encrypted before leaving your machine and Google/iCloud are only storing the encrypted passkeys and can't decrypt them.

Presumably encrypted with e.g. my iCloud password ?

Re: Passkeys are now enabled by default for Google users

#149

Post by kube-system »

TheRealPomax wrote: post #29
iand wrote: post #23

"To use passkeys, you just use a fingerprint, face scan or pin to unlock your device, and they are 40% faster than passwords — and rely on a type of cryptography that makes them more secure. " Who wrote this sentence? It's just a mess.

also, "ah yes, a several digit pin, famously more secure than a same-length password that adds even as little as letters".

Yes, a several digit pin that unlocks a long private key is more secure than a shared secret with eight characters on its own.

Re: Passkeys are now enabled by default for Google users

#150

Post by grotorea »

dilippkumar wrote: post #114

Hottake here: The biggest mistake that the passkeys movement did is try to make it sound more marketable at the cost of oversimplification. First up, these aren’t really “no password” mechanisms. They’re closer to ssh certificates. You need to authenticate through some other mechanism and then agree to do the equivalent of creating and installing ssh certificates on your device. The ssh certificates get synchronized…

But do you need passwords? The way things are setup now you do, the password is the recovery mechanism. If the recovery mechanism was instead something like "photo of face next to government ID" then Google could stop using passwords next week.

> But they can never serve as the primary authentication mechanism - that will still have to be a traditional authentication mechanism.

Why not?

Post reply on HN