Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

321–330 of 684 posts

Re: Passkeys are now enabled by default for Google users

#321

Post by gowld »

leotravis10 wrote: post #299
rawgabbit wrote: post #226

While I believe this is a step in the right direction. I have read too many horror stories of people who were locked out of their Google and iCloud accounts with no real possibility of getting back in. I don’t think I am alone in thinking I am on borrowed time. Someday, probably due to my own fault I will be locked out of Google and my digital life will be over. If a private company can offer a similar login method l…

Especially for normal and older folks and Google's history of very non-existent support. Not to mention that passkeys is a flawed system as well. [1] [2] [1] https://mastodon.laurenweinstein.org/@lauren/111103819626952... [2] https://mastodon.laurenweinstein.org/@lauren/111211366080459...

What is the flaw?

Re: Passkeys are now enabled by default for Google users

#322

Post by afiori »

mplewis wrote: post #311
darknavi wrote: post #296

Earlier quoted context omitted.

> nobody wants to allow plaintext export of passkeys. While noble, why? 1Password exports a plaintext file that has all of the credentials in plaintext already.

Because passkeys are supposed to be a bit more secure than plaintext passwords.

This sounds a bit like "a turned off computer is the only secure computer"

Re: Passkeys are now enabled by default for Google users

#323

Post by wutwutwat »

segmondy wrote: post #183
frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

I don't know how Google solved this, but it's an old solution. Shamir secret sharing. You break apart your keys into M pieces, where you need N pieces to reconstruct the key, so let's say 3/8. Then you need 3 pieces out of the 8 pieces it's broken into to recover your key. You take each of those 8 pieces and give to trusted sources. When you need to reconstruct your key, you have at least 3 of those give you the key…

Added bonus you can’t die unless someone locates each piece and destroys them all

Re: Passkeys are now enabled by default for Google users

#324

Post by rurp »

TheNewsIsHere wrote: post #176
qingcharles wrote: post #157

Earlier quoted context omitted.

I had a fire. I lost every single thing I own, except my landlord grabbed my phone, bless him. Otherwise I would have been totally stuck as all my TOTP apps are on there. Also, never lose your phone number. I can't get back into my Google account even though I have the username, password and recovery email because I can never get the SMS code.

> Also, never lose your phone number. I can't get back into my Google account even though I have the username, password and recovery email because I can never get the SMS code. This is an excellent point. Google seems to be uninterested in addressing this transparently, but despite their push for phishing-resistant MFA and first factor sign-in options, they still consider a phone number to be golden evidence. My fath…

I have heard and read about a number of similar cases where people can get completely locked out of their account despite being able to authenticate correctly, because they lost access to some other required resource that Google decided is essential. I'm very skeptical about the utility of these types of security policies. I'm sure they prevent hacking in some cases, but they also greatly increase the chance of a legit user permanently losing their account which is a pretty freaking bad outcome for someone who has all of their email, messages, photos, documents and more stored in their Google account.

Given the importance of these digital services I expect that refusing to provide support to users in this situation, as Google is well known to do, won't be legally tolerated at some point in the future. Unfortunately this won't be changing anytime soon, so the best we can do is inform others about the risks of relying solely on Google for anything important and hope people backup what they can.

Re: Passkeys are now enabled by default for Google users

#325

Post by afiori »

CharlesW wrote: post #283
efitz wrote: post #278

Earlier quoted context omitted.

Don't worry, if you lose your passkey all you need is access to your email to receive a password reset link.

That's literally the solution to "What if I lose all the passkeys associated with my account and I've also forgotten my password?"

Except for when it happens to your email account.

Re: Passkeys are now enabled by default for Google users

#326

Post by vorpalhex »

skarra wrote: post #273
vorpalhex wrote: post #238

Earlier quoted context omitted.

Rearranging deck chairs on the titantic. This whole scheme depends on either users being savvy enough to do vault backups or depending on service providers being functional. Both are quite doomed. Users have a path for passwords - they can write them down on paper and keep them with their important things. This tends to work for most folks. The backup story for passkeys is horrible. There is no path for my elderly re…

Passkeys represent the cumulative wisdom and experience (and compromises!) of the whole industry on how to keep users safe online. Appreciate your opinions that these efforts are doomed. It is safe to say, "We'll surely find out!"

"The Industry" also has interests like making password sharing impossible, uniquely tracking users and _doesn't care_ if users get locked out.

The industry does not put users first. It puts it's own risk reduction first.

Re: Passkeys are now enabled by default for Google users

#327

Post by gcr »

gowld wrote: post #321
leotravis10 wrote: post #299

Earlier quoted context omitted.

Especially for normal and older folks and Google's history of very non-existent support. Not to mention that passkeys is a flawed system as well. [1] [2] [1] https://mastodon.laurenweinstein.org/@lauren/111103819626952... [2] https://mastodon.laurenweinstein.org/@lauren/111211366080459...

What is the flaw?

AFAICT, the flaw is that passkeys are tied to device security. If I steal a naive person’s phone at the bar, and if I can guess that their PIN is 1234, then I can get into their Google account.

The criticism is based on the idea that most non-techie folks are unlikely to use a strong PIN and are unlikely to set up strong biometrics. There’s a related criticism about malware being able to steal passkeys on PC-based systems.

Re: Passkeys are now enabled by default for Google users

#328

Post by panarky »

gowld wrote: post #317
leotravis10 wrote: post #298

Lauren Weinstein is sounding the alarm on passkeys which is flawed and that it would make a huge headache for a lot of people especilly normal folks. https://mastodon.laurenweinstein.org/@lauren/111103819626952... https://mastodon.laurenweinstein.org/@lauren/111211366080459...

Does he explain the flaw anywhere? He says it's "easy to find" but apaprently he can't find it. https://mastodon.laurenweinstein.org/@lauren/111211489395997... Why is "weak device password" a reason to avoid passkeys, when those users presumably have weak service passwords as well?

It seems like his argument is that putting access to valuable accounts on your phone is a bad practice, because if your phone is stolen at the club after the thief watched you enter your code, then the thief can get at your banking, brokerage, crypto, password manager, etc.

But that argument doesn't address how passkeys somehow make that worse.

Sure, if you don't want your valuable stuff stolen, don't put it on your phone. But that's a problem whether you use passkeys or passwords or passwordless links sent to your email or SMS.

Re: Passkeys are now enabled by default for Google users

#329

Post by wutwutwat »

segmondy wrote: post #183
frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

I don't know how Google solved this, but it's an old solution. Shamir secret sharing. You break apart your keys into M pieces, where you need N pieces to reconstruct the key, so let's say 3/8. Then you need 3 pieces out of the 8 pieces it's broken into to recover your key. You take each of those 8 pieces and give to trusted sources. When you need to reconstruct your key, you have at least 3 of those give you the key…

I’m not in the crypto world to know why this is the way it is, but if you only need 3 pieces out of the 8 to reconstruct the key, why split it into 8? Is it to have a larger pool should you need it/higher odds of being able to gather 3 should some pieces be lost?
Post reply on HN