Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

261–270 of 684 posts

Re: Passkeys are now enabled by default for Google users

#261

Post by compiler-guy »

segmondy wrote: post #183
frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

I don't know how Google solved this, but it's an old solution. Shamir secret sharing. You break apart your keys into M pieces, where you need N pieces to reconstruct the key, so let's say 3/8. Then you need 3 pieces out of the 8 pieces it's broken into to recover your key. You take each of those 8 pieces and give to trusted sources. When you need to reconstruct your key, you have at least 3 of those give you the key…

Now there is a technically savvy solution that is a technical tour-de-force.

Very very cool.

But also completely unrealistic for the average person to use.

Re: Passkeys are now enabled by default for Google users

#262

Post by skarra »

jasonjayr wrote: post #239
skarra wrote: post #201

Earlier quoted context omitted.

Passkeys are a new technology and everyone - including users, service providers, and organizations - will take time to learn and adapt. In this interim period the recommended approach is to provide passkeys as an alternative to whatever is already offered. This is the approach that Google and many other service providers are taking. That said, you are bringing up the right questions on the general topic of account re…

How can a user, right now, take control + ownership of backing up their own pass keys, without iCloud or Google? This is a privilege I currently enjoy right now, and one I am not really eager to give up.

Password managers like Dashlane and 1Password have announced support for storing and synching passkeys. As passkeys becomes more popular I expect more providers to step up as well.

Ecosystem lockin is not how we make a new technology like this successful. And all players in the game understand that.

Re: Passkeys are now enabled by default for Google users

#263

Post by shepherdjerred »

reisse wrote: post #81

Always remember that passwords are protected by Fifth Amendment and similiar laws in other countries, but there is no law prohibiting officer to put your phone in front of your face to unlock it.

For iPhone users, you can mash your power button and it'll require a PIN to unlock the phone. Biometric auth will be disabled.

Re: Passkeys are now enabled by default for Google users

#264

Post by shepherdjerred »

LeoPanthera wrote: post #255

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.

It's a feature that came out just last month. Give them some time.

Re: Passkeys are now enabled by default for Google users

#265

Post by rkagerer »

If I may, I'll repeat a comment I made a few days ago:

Give me an implementation I can self-host, without Google, Apple, etc. having effective control (including claws in my relevant software supply chain) and with an easy user experience, where I can maintain secure backups (on my own infrastructure, thank you) and smooth transition to future devices, and ideally, if needed, securely export root keys (cause if I don't control them then someone else owns them), and maybe I'll be interested.

In the meantime plain old high-entropy passwords with a good manager gives me all those features and a simplicity that's hard to beat.

In my 30+ years of computing I've suffered more harm from failures of other companies than I have from any failure of my own diligence. The whole lesson learned is to reduce trust in them and, maybe I'm wrong, but everything I've read about passkeys and the like seems to put me at liberty of the companies developing and pushing the implementations of them down my throat. It will take a lot of trust before I give up my ability to copy/paste my credentials.

(https://news.ycombinator.com/item?id=37794379#37796842)

Re: Passkeys are now enabled by default for Google users

#266

Post by awegio »

jasonjayr wrote: post #239
skarra wrote: post #201

Earlier quoted context omitted.

Passkeys are a new technology and everyone - including users, service providers, and organizations - will take time to learn and adapt. In this interim period the recommended approach is to provide passkeys as an alternative to whatever is already offered. This is the approach that Google and many other service providers are taking. That said, you are bringing up the right questions on the general topic of account re…

How can a user, right now, take control + ownership of backing up their own pass keys, without iCloud or Google? This is a privilege I currently enjoy right now, and one I am not really eager to give up.

It depends on your web browser. Just see what happens here https://webauthn.io/

Firefox on Desktop tells me to "touch my security key". Not sure how that works. Firefox Android gives me a few hardware options to store my passkey to. Chrome Desktop asks me to enable Bluetooth. Chrome Android asks which Google Account to use.

Re: Passkeys are now enabled by default for Google users

#267

Post by rkagerer »

LeoPanthera wrote: post #255

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.

Do any of the third-party, self-hosted password managers provide a compatible passkey implementation that can actually be exported and backed up in a secure manner?

Re: Passkeys are now enabled by default for Google users

#268

Post by shadowgovt »

Passkeys make accessing all your online services as easy as accessing your phone.

... that is a statement that some people will find convenient and some people will find terrifying. As much as I'm excited for the convenience, this is my primary concern: how easy is it for a stranger to unlock your phone? Most people intentionally keep their phones easy to unlock because they're doing that dozens of times a day.

Re: Passkeys are now enabled by default for Google users

#269

Post by TacticalCoder »

So what is going to happen to those who were using U2F and then later on webauthn?

If you registered, say, a Yubikey, many moons ago, on your Google account. Is this Yubikey now automagically going to become a "passkey"?

Or will you have to choose between logging in with your Yubikey or with a new passkey? (say something Google controls, in your phone for example)

Re: Passkeys are now enabled by default for Google users

#270

Post by idle_zealot »

LeoPanthera wrote: post #255

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.

Isn't that the point of Passkeys? The user isn't allowed to interface with them directly, so social engineering can't compromise them [1]. Rather than move your passkey between devices, you're meant to generate a different passkey for each device, then register all of them with the relevant service, like SSH keys.

1: of course, a user could still be tricked into adding an attacker's passkey to their account or something

Post reply on HN