Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

241–250 of 684 posts

Re: Passkeys are now enabled by default for Google users

#241

Post by dotancohen »

frabcus wrote: post #21
frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

To add, it is pretty poor there is no FAQ linked to from that post to answer basic non-technical questions as to how this is intended to be used. I assume as a technical person, the answer is I should have a backup device with a friend and/or store my passkeys somehow on my Apple or Microsoft or password manager account as well. But it needs more explanation in detail from Google!

So now that "friend" has access to your account? How is that more secure than my 32 random character password I store in an encrypted Keepass database that I back up offline?

Re: Passkeys are now enabled by default for Google users

#242

Post by latchkey »

nicolaslem wrote: post #237
latchkey wrote: post #210

Earlier quoted context omitted.

Don't tie your google account recovery to SMS. I left that option blank.

All the Google accounts I had to use for work eventually required a phone number.

Google Workspace is different than a private account, which is what we are talking about here.

With Google Workspace an admin can reset / disable your 2FA, so that part is out of your hands anyway.

Finally, I don't see anything in Google Workspace that requires a phone number. Someone can correct me if I'm wrong there.

Re: Passkeys are now enabled by default for Google users

#243

Post by lxgr »

kube-system wrote: post #118
tshaddox wrote: post #90

Earlier quoted context omitted.

What’s the standard then? Should it be possible to recover your account without possessing any evidence whatsoever that you are the person you say you are?

Other businesses have humans on staff which will verify your identity documents. Google simply chooses not to do this, because it is expensive, and their "users" are not their customers.

That is not without risk either:

Many more people have a copy of my passport than have access to my Yubikey or recovery phone number.

Re: Passkeys are now enabled by default for Google users

#244

Post by jiveturkey »

I feel that this is net negative.

You have to meet people where they are at.

per some support document (sorry lost the link), by default, Android users will have passkeys synced to their google account. So first of all, this is a lock-in play on Google's part. The passkey FAQ only mentions iCloud, so second of all it's a duopoly reinforcement. (This really needed Apple to first release passkey support.)

Beyond that, there are so very many ifs, ands, and buts around recovery and third party device usage that a typical user can't really keep it straight.

It's more convenient ... until it isn't.

Re: Passkeys are now enabled by default for Google users

#245

Post by postalrat »

andrewstuart2 wrote: post #113
progbits wrote: post #52

Earlier quoted context omitted.

PIN for secure module with throttling and max wrong attempt count is indeed safer than a password you can brute force offline.

Brute forcing offline kinda only works if you have a stolen hash or artifact like that. For a service like Google, they definitely have rate limits on password attempts. I'm not saying I prefer either one here, just that password authentication doesn't automatically mean you can brute force offline.

The real key is stored in a chip. Your pin unlocks the real key. The chip has hardware to rate limit pin attempts.

These types of chips tend to have many layers of physical security to protect the real key.

Re: Passkeys are now enabled by default for Google users

#247

Post by lxgr »

jasonjayr wrote: post #63
lopis wrote: post #44

Earlier quoted context omitted.

Ah right, account recovery. The one that tells me the only way to sign in to my old Google account is to use a phone that no longer exists.

or to fax/email/send in government identity documents.

Despite what many companies seem to believe, looking at a copy of somebody's identification presented remotely documents does not constitute identity verification.

Photo ID is (relatively) secure in exactly one use case: Verifying that a person standing in front of you is who they claim to be. Everything else is inane pseudo-security.

Re: Passkeys are now enabled by default for Google users

#248

Post by verytrivial »

rawgabbit wrote: post #226

While I believe this is a step in the right direction. I have read too many horror stories of people who were locked out of their Google and iCloud accounts with no real possibility of getting back in. I don’t think I am alone in thinking I am on borrowed time. Someday, probably due to my own fault I will be locked out of Google and my digital life will be over. If a private company can offer a similar login method l…

Disaster recovery. This is 100% my biggest worry with 2FA/MFA. I also think this is one of the reasons stuff like PGP never took off (don't @ me regarding perfect forward secrecy): the problem has always been managing some little, precious thing and the ramifications of what happens if it put beyond use or is used by some bad actor.

Re: Passkeys are now enabled by default for Google users

#249

Post by syntaxing »

rawgabbit wrote: post #226

While I believe this is a step in the right direction. I have read too many horror stories of people who were locked out of their Google and iCloud accounts with no real possibility of getting back in. I don’t think I am alone in thinking I am on borrowed time. Someday, probably due to my own fault I will be locked out of Google and my digital life will be over. If a private company can offer a similar login method l…

100% agreed. I’m excited about the passwordless future but one unexplained ban from them and it’s like losing your physical wallet.

Re: Passkeys are now enabled by default for Google users

#250

Post by Msw242 »

havnagiggle wrote: post #220
frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

Just happened to my in-law. She dropped her phone on the stairs, screen cracked, and became unresponsive. I gave her an older phone I had and swapped the sim fine. But she couldn't figure out how to log in to Google account because it was so adamant telling her to use her phone. Her laptop was logged out of her email, etc. Fortunately I have backup tokens for her from a previous incident heh. I have no idea what othe…

Get a lockbox at the bank
Post reply on HN