Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

161–170 of 684 posts

Re: Passkeys are now enabled by default for Google users

#161

Post by kube-system »

michaelt wrote: post #125
isykt wrote: post #69

Earlier quoted context omitted.

So why not just have a password that then unlocks the passkey? I already have a password manager.

The standards group that was behind Fido/U2F has been taken over by people who want to push a new product. That new product is "Log in with your phone" and phone lock screens allow biometrics and pins. Password managers are not relevant, as you don't use a password manager to unlock your phone. The people behind the takeover don't really give a shit about Yubikey-style tokens (which haven't achieved much market penet…

More like the other way around -- the existing FIDO/U2F crowd was a bunch of businesses that made money selling keys. And that's why adoption was a rounding error, it was infinitely more expensive than a free password, so few implemented it. This is the obvious solution -- we're already carrying devices with a secure enclave, just use that, it's free.

Re: Passkeys are now enabled by default for Google users

#162

Post by jkaplowitz »

goosedragons wrote: post #55
jkaplowitz wrote: post #39

Earlier quoted context omitted.

I think you’ll still need a password on your account for cases where no passkey is available, and possibly for other scenarios of heightened fraud risk. That’s why the setting they’re describing in the blog post is named “Skip password when possible”. Disclaimer: although I worked for Google many years ago in a role entirely unrelated to Google account authentication, I have no inside info on this announcement, could…

I think there's going to be an issue with people forgetting passwords they lasted used 5 years ago. Recovery needs to be much better thought out.

I agree that recovery is an important question. Maybe they will make sure to prompt for a password at least every N months? I have no idea what their answer for this may be, but they probably have one.

Re: Passkeys are now enabled by default for Google users

#163

Post by nottorp »

No one has managed yet to explain to me how you recover access to an account using these passkeys if you somehow lose access to all your devices.

Note that i said "all your devices" so the cloud backup you dream of will also be inaccessible because I can't authenticate to that either.

And I know about backups... what about your average user who is likely to own a single phone and no other device? They lose access to everything if they drop it in the toilet?

Re: Passkeys are now enabled by default for Google users

#165

Post by vel0city »

ed312 wrote: post #34
powera wrote: post #10

Nope, not signing up. The trend from Google continues to be towards "if you lose your phone with your credentials, you will be unable to log in". And Google refuses to create a scalable system that allows you access to your account by verifying your identity in person. This is a recipe for disaster. And, possibly, a warning to move off GMail before it gets worse.

I'm about at the threshold for wanting to de-google my life. Do you have an alternative email provide you recommend?

Several months ago I moved my family's email hosting to Zoho. Its been pretty solid. The web client is really nice, its got pretty good mobile apps, it provides IMAP/Exchange Sync on their cheapest paid tier so you don't need their apps. Zoho has a 5 user free tier of just email, but you're then limited to their apps. I'm using the Mail Lite tier with the larger 10GB storage which is $1.25/mo/user billed annually.

They have some tools to migrate email. I was migrating from an IMAP source, the migration was pretty quick and painless.

Re: Passkeys are now enabled by default for Google users

#167

Post by doublerabbit »

orev wrote: post #130
JaneLovesDotNet wrote: post #109

Correct me if I'm wrong but isn't it fair to say that passkeys secured on your phone are more secure than 1FA (password) but less secure than "traditional" 2FA? Passkey 2FA: unlock your phone and the passkey on your phone can log you in. Traditional 2FA: remember a password AND unlock your phone (where your TOTP is stored) and you can login If I were to rate all 3 methods on a scale of 1 to 10, for convenience and se…

Nobody should be using a remembered password anymore. Most people are likely using the phone for both the password and the MFA code.

> Nobody should be using a remembered password anymore.

Nobody is a strong number, why?

I don't want to use biometrics for logging in to my SSH terminal. I dislike having to use my phone for authentication methods.

I go many places without my phone. Even tempted to gon on holiday without it. Maybe I'm just one of the few who actually enjoys turning it off when coding, developing or whatever.

Re: Passkeys are now enabled by default for Google users

#168

Post by TMWNN »

vdelitz wrote: post #119
TMWNN wrote: post #83

The post mentions eBay as a site using passkeys. eBay's implementation on PC accepts Touch ID, while Google's implementation did not the last time I tried it.

try this one: https://g.co/passkeys (you need to have set up a passkey before though)

Thank you. I am embarrassed to say that using the site reminded me that, actually, I had already created Touch ID passkeys for my Google accounts. I think what confused me is that passkeys were not available for Google Workspace yet, so my account there couldn't use passkeys. That has now changed.

Re: Passkeys are now enabled by default for Google users

#169

Post by tzs »

isykt wrote: post #69
kube-system wrote: post #8

Earlier quoted context omitted.

It isn't, and this isn't authentication with a pin. Passkeys also requires the device. Using a pin with this is 2-factor. Pin + hardware token.

So why not just have a password that then unlocks the passkey? I already have a password manager.

You can have that by storing passkeys in your password manager, if it has support for that. Currently 1Password does, and BitWarden either does or is suppose to soon. I haven't looked at any others.

Re: Passkeys are now enabled by default for Google users

#170

Post by ghaff »

grotorea wrote: post #150
dilippkumar wrote: post #114

Hottake here: The biggest mistake that the passkeys movement did is try to make it sound more marketable at the cost of oversimplification. First up, these aren’t really “no password” mechanisms. They’re closer to ssh certificates. You need to authenticate through some other mechanism and then agree to do the equivalent of creating and installing ssh certificates on your device. The ssh certificates get synchronized…

But do you need passwords? The way things are setup now you do, the password is the recovery mechanism. If the recovery mechanism was instead something like "photo of face next to government ID" then Google could stop using passwords next week. > But they can never serve as the primary authentication mechanism - that will still have to be a traditional authentication mechanism. Why not?

> If the recovery mechanism was instead something like "photo of face next to government ID" then Google could stop using passwords next week.

Think about the failure mechanisms. What government ID? Why might the face change? Etc. Even if these sound like outliers, at scale essentially anything will happen.

Post reply on HN