Passkeys are now enabled by default for Google users

Post by abdullahkhalids » Tue, Oct 10, 2023, 11:40 PM UTC

Shank wrote: post #364

jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. I believe all of the issues you've described, but you can usually add multiple passkeys to each service. There is nothing stopping you from adding your iPhone and a cheap android phone and having redundancy, or using 1Password and storing your passkey in there. iPhone back…

Post by pseudalopex » Tue, Oct 10, 2023, 11:41 PM UTC

skarra wrote: post #201

frabcus wrote: post #13

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again?

Passkeys are a new technology and everyone - including users, service providers, and organizations - will take time to learn and adapt. In this interim period the recommended approach is to provide passkeys as an alternative to whatever is already offered. This is the approach that Google and many other service providers are taking. That said, you are bringing up the right questions on the general topic of account re…

Post by LeoPanthera » Tue, Oct 10, 2023, 11:42 PM UTC

maxwellg wrote: post #383

LeoPanthera wrote: post #255

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.

1Password's Passkey support feels very aggressively growth-hacky to me. They intercept calls to `window.credentials` and if you want to use 1Password along side other verifiers like Yubikey, you need to go into your settings and disable their passkeys offering entirely. It's similar to how they also intercept (and globally disable!) Google One Tap prompts in order to show their own OAuth prompt. I only use their Chro…

Post by sbuk » Tue, Oct 10, 2023, 11:44 PM UTC

secabeen wrote: post #187

nottorp wrote: post #163

No one has managed yet to explain to me how you recover access to an account using these passkeys if you somehow lose access to all your devices. Note that i said "all your devices" so the cloud backup you dream of will also be inaccessible because I can't authenticate to that either. And I know about backups... what about your average user who is likely to own a single phone and no other device? They lose access to…

Now extend that; it's not you trying to recover access, it's your relatives or heirs trying to do so, because you are incapacitated or dead.

Post by Dlanv » Tue, Oct 10, 2023, 11:45 PM UTC

kahnclusions wrote: post #409

metafunctor wrote: post #391

Earlier quoted context omitted.

The point is that the private key resides on a tamperproof piece of hardware. Malware, viruses, or shoulder surfers cannot copy the key. The solution is to set up multiple pieces of secure hardware, not writing down the keys to the castle on a piece of paper.

Great so now people need to be rich enough to own multiple phones? Really. The solution can’t be “buy multiple devices” when the average person can barely afford to maintain one working device.