Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

431–440 of 684 posts

Re: Passkeys are now enabled by default for Google users

#431

Post by eduction »

metafunctor wrote: post #352
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Why do you believe that introducing support for passkeys inherently makes the situation worse? If you don't trust them, you're not forced to use them; traditional methods still exist. In any case, you should have multiple methods. It could be passkeys on multiple devices. It could be TOTP, plus recovery codes in a safe. Passkeys are just one more method. For the longest time, the gold standard for authenticating peop…

Much easier to have spare yubikeys than a spare biometrically secure smartphone. Perfect is the enemy of good.

Re: Passkeys are now enabled by default for Google users

#432

Post by jjav »

jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery.

Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future.

People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password).

And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable.

Re: Passkeys are now enabled by default for Google users

#433

Post by eduction »

brundolf wrote: post #382
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue

I like this idea of authenticating yourself by typing things in.

Re: Passkeys are now enabled by default for Google users

#434

Post by imran-iq »

sbuk wrote: post #347
SheinhardtWigCo wrote: post #308

Earlier quoted context omitted.

The whole point is vendor lock-in.

How does that work if you can register multiple different keys using different devices from different vendors on an account? Edit: I took the last sentence out, it was childish on my part.

What are the vendor options though? (I think) its Google, Apple, Microsoft, Yubico and 1password? None of which support exporting the keys as per other comments in this thread.

Also (i think) none of them are open source?

Re: Passkeys are now enabled by default for Google users

#435

Post by Habgdnv »

zb3 wrote: post #173
ellisv wrote: post #41

Earlier quoted context omitted.

What happens if you forget your password?

I reset it using my SMS 2FA phone. I can't lose that number because in my country I'm legally entitled to it.

Could you please specify which country you are referring to where individuals are legally entitled to keep their phone number? Thank you!

Re: Passkeys are now enabled by default for Google users

#436

Post by bojo »

segmondy wrote: post #289
bojo wrote: post #257

Earlier quoted context omitted.

I had the same idea about a decade ago but never bothered to try to implement it. I felt like it would have suffered from the same problem all other technologies have in security: overly complex user interactions. The concept makes sense, but getting N other people to commit is overhead the average user probably doesn't want to deal with.

So I preferred the idea of regular folks for backup, for security reasons. I thought of the idea of professional users like say your bank or 3rd party. The issue is that it's far easier for the govt to subpoena those pro 3rd parties and recover your key. Whereas, they would have to know which of your friends you used for key recovery to be able to do that. The idea was to make it tough for a bad/powerful actor to ste…

I wholeheartedly agree with where you were aiming your goals. Other thoughts I've had:

- What if access is time critical but your backup people are distributed across timezones? Or they aren't available for some reason? Could be hours to days before you could recover your account

- Adding/removing people as they enter/exit your life could make it a challenge to maintain (PGP + trust vibes)

Re: Passkeys are now enabled by default for Google users

#437

Post by idle_zealot »

metafunctor wrote: post #390
selcuka wrote: post #386

Earlier quoted context omitted.

There are workarounds, but that doesn't mean that passkeys is a half-baked technology. The real, simple solution would be a way to write down the passkey, similar to an SSH private key.

A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…

> as a service provider, I'd like to see some device attestation

As a user I hope you don't get it. Having an easy way for services to require that everyone using them is doing so via the official app on an iPhone or OEM Android phone sounds like a nightmare.

Re: Passkeys are now enabled by default for Google users

#438

Post by ok_dad »

ahhhhh! yet another setting I have to go disable in my Google account. I use yubikeys for 2fa for a dang reason, don’t try and force me to do stupid shit like this which will actually decrease my security!

I’m glad I only keep my Google account around for historical purposes and YouTube.

Re: Passkeys are now enabled by default for Google users

#439

Post by bombcar »

abdullahkhalids wrote: post #411
Shank wrote: post #364

Earlier quoted context omitted.

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. I believe all of the issues you've described, but you can usually add multiple passkeys to each service. There is nothing stopping you from adding your iPhone and a cheap android phone and having redundancy, or using 1Password and storing your passkey in there. iPhone back…

> I believe all of the issues you've described, but you can usually add multiple passkeys to each service. How does this work? Do I have to visit the website of each service from my secondary device for it to get the alternate passkey?

Yes. You go an add secondary passkey when logged in on another device. Or with another tubikey.

But not all setups support this. Some only allow one. Obvious issues abound.

Re: Passkeys are now enabled by default for Google users

#440

Post by javagram »

metafunctor wrote: post #390
selcuka wrote: post #386

Earlier quoted context omitted.

There are workarounds, but that doesn't mean that passkeys is a half-baked technology. The real, simple solution would be a way to write down the passkey, similar to an SSH private key.

A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…

> A main idea of passkeys is that the private keys are bound to hardware and cannot be copied.

This seems incorrect. “ Like passwords, passkeys are encrypted and stored in your iCloud Keychain”

I also just recently set up some passkeys via 1Password and they are also not hardware bound.

Post reply on HN