Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

391–400 of 684 posts

Re: Passkeys are now enabled by default for Google users

#391

Post by metafunctor »

brundolf wrote: post #382
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue

The point is that the private key resides on a tamperproof piece of hardware. Malware, viruses, or shoulder surfers cannot copy the key.

The solution is to set up multiple pieces of secure hardware, not writing down the keys to the castle on a piece of paper.

Re: Passkeys are now enabled by default for Google users

#392

Post by xg15 »

darknavi wrote: post #296
jxcl wrote: post #286

Earlier quoted context omitted.

Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys. See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd... Re. your point about 1Password going down: Your passwords and pass…

> nobody wants to allow plaintext export of passkeys. While noble, why? 1Password exports a plaintext file that has all of the credentials in plaintext already.

I guess "100% secure against phising" is incompatible with "the user can in any way access the key" because if you knew the key, in theory some super-convincing phishing site could get you to spill it.

I still think the real reason is lock-in, but I could imagine this is their official justification.

Re: Passkeys are now enabled by default for Google users

#393

Post by redrblackr »

I was surprised by the amount of dislike of passkeys in this thread until I realised I had misunderstood what passkeys refer to.

I thought it was the same as security keys, which are like digital, but still physical, keys. They are awesome, one just has to have two and you are set. Passkeys tied to a cloud service or device like a smartphone are a terrible alternative (comparatively), from privacy and security (as in not get locked out) standpoints. At least they use fido2 so pushing for passkeys add support for security keys at the same time..

Re: Passkeys are now enabled by default for Google users

#394

Post by hypothesis »

metafunctor wrote: post #390
selcuka wrote: post #386

Earlier quoted context omitted.

There are workarounds, but that doesn't mean that passkeys is a half-baked technology. The real, simple solution would be a way to write down the passkey, similar to an SSH private key.

A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…

> This is also why, as a service provider, I'd like to see some device attestation. I want to know that the keys being used here are not written on a fucking piece of paper.

This is precisely why user should run away. Service provider is moving liability to end user and washing their hand away, while user gets screwed if anything happens during vacation.

Re: Passkeys are now enabled by default for Google users

#395

Post by drdaeman »

jesseendahl wrote: post #380
drdaeman wrote: post #356

Earlier quoted context omitted.

All those issues were obvious from the day zero, and raised multiple times by many people. They're deliberately ignored by the stakeholders. They strongly want to lock you in to their own authentication platforms (iCloud Keychain, Windows Hello, 1Password*), that's why they don't want to address this. It's impossible they're not aware about those issues. Anyone with a brain and some technical expertise would come up…

You can recover access to your iCloud Keychain even if you've lost 100% of your devices. See the section titled "Recovery security" in this article: https://support.apple.com/en-us/102195 Relevant excerpt for those too lazy to click through: "However, it's also important that passkeys be recoverable even in the event that all associated devices are lost. Passkeys can be recovered through iCloud keychain escrow, which…

If I understand it correctly, this only works on another Apple device, though. So you'll need a spare iPhone or something.

Also, I'm pretty sure if Apple decides to block your iCloud account, you're most likely SOL.

Re: Passkeys are now enabled by default for Google users

#396

Post by pseudalopex »

metafunctor wrote: post #352
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Why do you believe that introducing support for passkeys inherently makes the situation worse? If you don't trust them, you're not forced to use them; traditional methods still exist. In any case, you should have multiple methods. It could be passkeys on multiple devices. It could be TOTP, plus recovery codes in a safe. Passkeys are just one more method. For the longest time, the gold standard for authenticating peop…

> If you don't trust them, you're not forced to use them; traditional methods still exist.

I predict this will not be true always.

Re: Passkeys are now enabled by default for Google users

#397

Post by zerocrates »

chownie wrote: post #367
jackson1442 wrote: post #334

Earlier quoted context omitted.

What are the odds that someone with a passcode 1234 is 1/ already signed into Google on their phone or 2/ has their Google password already saved in the device password manager (since it asks you to save it every time you sign in) which is also protected by the device pin? At least in this case the thief has to steal the physical phone instead of guessing "password123" on the google signin prompt from the comfort of…

> What are the odds that someone with a passcode 1234 is 1/ already signed into Google on their phone ...very high? I don't understand how this is unlikely, pretty much every phone owner with a google account is signed into that account on their phone.

The point is that the odds are very high, i.e. if you've stolen their phone and know the PIN, you're very likely already in their account, passkey or no passkey.

Re: Passkeys are now enabled by default for Google users

#398

Post by hypothesis »

metafunctor wrote: post #352
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Why do you believe that introducing support for passkeys inherently makes the situation worse? If you don't trust them, you're not forced to use them; traditional methods still exist. In any case, you should have multiple methods. It could be passkeys on multiple devices. It could be TOTP, plus recovery codes in a safe. Passkeys are just one more method. For the longest time, the gold standard for authenticating peop…

> If you don't trust them, you're not forced to use them; traditional methods still exist.

Still being the operative word. Consider situation with running banking apps without hardware attestation, etc

Re: Passkeys are now enabled by default for Google users

#399

Post by sbuk »

december456 wrote: post #368

I wont add on to the technical aspect of the discussion, but this whole article is "its easier and its faster and its less expensive for you!!", a data-harvesting tactic having been done for years. Please think, people. I get the security aspect, but this technology gives up an astronomic amount of personal freedom - even if vendor lock-in is somehow eliminated - and biometric data.

Please think. The biometric data is on-device. This is, in very simplistic terms, public key cryptography where the private key is locked to a device. How that device is authenticated is immaterial to passkey authentication to another service.

Re: Passkeys are now enabled by default for Google users

#400

Post by CogitoCogito »

skarra wrote: post #273
vorpalhex wrote: post #238

Earlier quoted context omitted.

Rearranging deck chairs on the titantic. This whole scheme depends on either users being savvy enough to do vault backups or depending on service providers being functional. Both are quite doomed. Users have a path for passwords - they can write them down on paper and keep them with their important things. This tends to work for most folks. The backup story for passkeys is horrible. There is no path for my elderly re…

Passkeys represent the cumulative wisdom and experience (and compromises!) of the whole industry on how to keep users safe online. Appreciate your opinions that these efforts are doomed. It is safe to say, "We'll surely find out!"

> Passkeys represent the cumulative wisdom and experience (and compromises!) of the whole industry on how to keep users safe online.

That is true _if_ you do not highly weigh all the concerns that have been brought up in this thread today. I do not trust Google to help if things go wrong so why would I ever consider such a system wise? Frankly, you seem to be ignoring concerns if they contradict your belief that this system is better. I'm reminded of Upton Sinclair.

Post reply on HN