Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

181–190 of 684 posts

Re: Passkeys are now enabled by default for Google users

#181

Post by neonnomad »

ed312 wrote: post #34
powera wrote: post #10

Nope, not signing up. The trend from Google continues to be towards "if you lose your phone with your credentials, you will be unable to log in". And Google refuses to create a scalable system that allows you access to your account by verifying your identity in person. This is a recipe for disaster. And, possibly, a warning to move off GMail before it gets worse.

I'm about at the threshold for wanting to de-google my life. Do you have an alternative email provide you recommend?

I would recommend Protonmail because you can also have a plan that allows you to use your own domain. The interface is much better than Google IMHO and the spam filtering is up there as well.

Other alternatives:

https://www.hey.com

https://www.skiff.com

https://www.fastmail.com

https://www.icloud.com with advanced protection turned on

Re: Passkeys are now enabled by default for Google users

#182

Post by ngrilly »

konschubert wrote: post #148
ngrilly wrote: post #132

Earlier quoted context omitted.

The passkeys are encrypted before leaving your machine and Google/iCloud are only storing the encrypted passkeys and can't decrypt them.

Presumably encrypted with e.g. my iCloud password ?

Kind of, but it's more complicated than that. Details there (and in the link at then bottom of the page): https://support.apple.com/en-us/102195

Re: Passkeys are now enabled by default for Google users

#183

Post by segmondy »

frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

I don't know how Google solved this, but it's an old solution. Shamir secret sharing. You break apart your keys into M pieces, where you need N pieces to reconstruct the key, so let's say 3/8. Then you need 3 pieces out of the 8 pieces it's broken into to recover your key. You take each of those 8 pieces and give to trusted sources. When you need to reconstruct your key, you have at least 3 of those give you the key and you recover.

How does this look in implementation. When I Implemented this in multipasskey (YC demo). It would ask you to select contacts you trusted. Then it would send the sharded parts of the key in the background to them. If you need to recover, you make a request to them. It would reconstruct your device key when you got enough pieces. Once you have your device key, it would download your encrypted backup of keys from the remove server and you are back as new.

I called my project multipasskey in 2017/2018 and applied to YC with a working demo and they said nope. I'm going to assume that I sucked at selling it. ;-)

Re: Passkeys are now enabled by default for Google users

#184

Post by sneak »

fh9302 wrote: post #127
sneak wrote: post #37

Earlier quoted context omitted.

Not just typically - on iOS, you cannot use them at all without iCloud enabled.

On iOS you can use third party software to manage passkeys, there is no inherent cloud requirement.

Can you? If so, this is great news.

What apps support this?

Re: Passkeys are now enabled by default for Google users

#185

Post by gruez »

fh9302 wrote: post #127
sneak wrote: post #37

Earlier quoted context omitted.

Not just typically - on iOS, you cannot use them at all without iCloud enabled.

On iOS you can use third party software to manage passkeys, there is no inherent cloud requirement.

Source?

>Note: To use passkeys, iOS 16, iPadOS 16, macOS 13, or tvOS 16 (or later) is required. iCloud Keychain and two-factor authentication must also be turned on.

https://support.apple.com/guide/iphone/use-passkeys-to-sign-...

Re: Passkeys are now enabled by default for Google users

#186

Post by secabeen »

kseifried wrote: post #177
frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

Updated my paper: https://news.ycombinator.com/item?id=37833390 Scenarios dealing with the loss of Passkeys: The scenarios for dealing with the loss of Passkeys are effectively the same as dealing with the loss of your Password Manager (if you use one) or otherwise stored passwords. Dealing with the loss of all your devices that use Passkeys If you manage to lose access to all your devices that are used to authentica…

This is accurate, but by putting your passkey backup with that external entity, you are putting all your keys in that basket. Passwords have an obvious, backup option with zero dependencies on third-parties: A printed list in a fire safe. I would not advise users go heavily with any passkey provider that does not provide a physical backup of a similar form that can be secured through non-technical means, and that can be used by an heir or attorney to act as you when you are unable to do so.

Re: Passkeys are now enabled by default for Google users

#187

Post by secabeen »

nottorp wrote: post #163

No one has managed yet to explain to me how you recover access to an account using these passkeys if you somehow lose access to all your devices. Note that i said "all your devices" so the cloud backup you dream of will also be inaccessible because I can't authenticate to that either. And I know about backups... what about your average user who is likely to own a single phone and no other device? They lose access to…

Now extend that; it's not you trying to recover access, it's your relatives or heirs trying to do so, because you are incapacitated or dead.

Re: Passkeys are now enabled by default for Google users

#188

Post by secabeen »

powera wrote: post #10

Nope, not signing up. The trend from Google continues to be towards "if you lose your phone with your credentials, you will be unable to log in". And Google refuses to create a scalable system that allows you access to your account by verifying your identity in person. This is a recipe for disaster. And, possibly, a warning to move off GMail before it gets worse.

> And Google refuses to create a scalable system that allows you access to your account by verifying your identity in person.

People complain about government services, but this is something that government is good at. The DMV serves everybody, regardless of personal views, criminal records, etc. Companies can refuse service to anyone for any reason. What happens when you put all your eggs in Google's basket, and then they decide to close your account with no recourse.

Re: Passkeys are now enabled by default for Google users

#189

Post by the_snooze »

secabeen wrote: post #186
kseifried wrote: post #177

Earlier quoted context omitted.

Updated my paper: https://news.ycombinator.com/item?id=37833390 Scenarios dealing with the loss of Passkeys: The scenarios for dealing with the loss of Passkeys are effectively the same as dealing with the loss of your Password Manager (if you use one) or otherwise stored passwords. Dealing with the loss of all your devices that use Passkeys If you manage to lose access to all your devices that are used to authentica…

This is accurate, but by putting your passkey backup with that external entity, you are putting all your keys in that basket. Passwords have an obvious, backup option with zero dependencies on third-parties: A printed list in a fire safe. I would not advise users go heavily with any passkey provider that does not provide a physical backup of a similar form that can be secured through non-technical means, and that can…

Passkeys aren't inherently un-backup-able. I do agree though that the most common forms of it (e.g., Android/iOS/Windows secure enclave passkeys) need better ways of recovery and remediation.

That said, what you describe is easily doable in other forms. For hardware tokens, you can have a spare Yubikey that's authorized on your accounts and keep that in a fire safe with its unlock PIN. For something like 1Password, you can print out a recovery kit [1] with the secret key and unlock password.

[1] https://support.1password.com/emergency-kit/

Re: Passkeys are now enabled by default for Google users

#190

Post by kseifried »

secabeen wrote: post #186
kseifried wrote: post #177

Earlier quoted context omitted.

Updated my paper: https://news.ycombinator.com/item?id=37833390 Scenarios dealing with the loss of Passkeys: The scenarios for dealing with the loss of Passkeys are effectively the same as dealing with the loss of your Password Manager (if you use one) or otherwise stored passwords. Dealing with the loss of all your devices that use Passkeys If you manage to lose access to all your devices that are used to authentica…

This is accurate, but by putting your passkey backup with that external entity, you are putting all your keys in that basket. Passwords have an obvious, backup option with zero dependencies on third-parties: A printed list in a fire safe. I would not advise users go heavily with any passkey provider that does not provide a physical backup of a similar form that can be secured through non-technical means, and that can…

The problem with that is people don't have fire safes. Or homes in some cases (e.g. many unhoused people have smartphones now). Also people need to travel and do recovery without having to fly home to their safe.

The idea that printing a backup is easy and an option for many people is often not the case.

Post reply on HN