Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

441–450 of 684 posts

Re: Passkeys are now enabled by default for Google users

#441

Post by Tijdreiziger »

jsperx wrote: post #314
segmondy wrote: post #279

Earlier quoted context omitted.

How? The usage was very easy. You select a contact and add them as your recovery contact (by selecting contact from your contact list) The system adds the key in the background. If they don't have the app, the app asks you to tell them to install the app (viral growth?). The users didn't need to know any thing technical. But install app, and click yes/no like they do with a 2FA app.

I think the challenge is more coordinating the 8 people who will be a trusted part of your life long-term. Also they’d have to be sure to keep their fragments of the key intact through replacing devices, etc, no? Seems like just keeping a Yubikey in a safe deposit box would be simpler.

Define ‘safe deposit box’?

If it is a safe at your home, you need to have a fixed home address in the first place, and the usual advice about off-site backups also applies.

If it is at friends or family, you’re back at the same problem.

If it is a rented deposit box, you need to trust the company you rent it from (banks don’t usually offer such services anymore, and there are risks like in [1])

[1] https://www.nytimes.com/2019/07/19/business/safe-deposit-box... (archive: https://archive.is/7qbkR)

Re: Passkeys are now enabled by default for Google users

#442

Post by brnt »

metafunctor wrote: post #390
selcuka wrote: post #386

Earlier quoted context omitted.

There are workarounds, but that doesn't mean that passkeys is a half-baked technology. The real, simple solution would be a way to write down the passkey, similar to an SSH private key.

A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…

Why is a piece of paper not a piece of hardware? We do this for TOTP too as a last resort, nothing wrong with that.

Re: Passkeys are now enabled by default for Google users

#443

Post by CatWChainsaw »

A thousand nopes. I don't care if it is 100% secure. This is one instance where "cloud" is better. Having the mother of all failsafes be a device that can be stolen, broken, or just plain borked on a dime, and potentially your entire digital life is now locked from your access for good? Great innovation there google, please kill this in 18 months please.

Re: Passkeys are now enabled by default for Google users

#444

Post by brundolf »

metafunctor wrote: post #391
brundolf wrote: post #382

Earlier quoted context omitted.

Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue

The point is that the private key resides on a tamperproof piece of hardware. Malware, viruses, or shoulder surfers cannot copy the key. The solution is to set up multiple pieces of secure hardware, not writing down the keys to the castle on a piece of paper.

It's still a stronger key than virtually any password would be, and is (to my understanding) resistant to data breaches

But information sovereignty is crucial when it comes to this stuff; losing that is a regression that will cause problems

Re: Passkeys are now enabled by default for Google users

#445

Post by FireBeyond »

bombcar wrote: post #439
abdullahkhalids wrote: post #411

Earlier quoted context omitted.

> I believe all of the issues you've described, but you can usually add multiple passkeys to each service. How does this work? Do I have to visit the website of each service from my secondary device for it to get the alternate passkey?

Yes. You go an add secondary passkey when logged in on another device. Or with another tubikey. But not all setups support this. Some only allow one. Obvious issues abound.

> But not all setups support this. Some only allow one. Obvious issues abound.

I'd go as far as to say "most setups don't support this. Most only allow one".

The services I've seen so far that support multiple passkeys are in the minority.

Re: Passkeys are now enabled by default for Google users

#446

Post by cpuguy83 »

jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

This is just bad and uninformed advice.

Adding a passkey to an account is like adding a yubikey to an account (experience wise). You can (typically) add multiple keys to your account.

It's also not all or nothing. You can (in every service I've setup) still have a password and an even a TOTP.

Re: Passkeys are now enabled by default for Google users

#447

Post by tmpX7dMeXU »

Dlanv wrote: post #419
kahnclusions wrote: post #409

Earlier quoted context omitted.

Great so now people need to be rich enough to own multiple phones? Really. The solution can’t be “buy multiple devices” when the average person can barely afford to maintain one working device.

Your computer can also be a passkey. I currently use both my laptop and my computer as a passkey, and a USB drive. So I have 3 backups to my Google account. It is true that you do need to be rich enough to own a phone and ~100 USD of something else (laptop or USB), which does put redundancy out of the reach of a large portion of the world. But then they can just use regular 2fa at the expense of not being phishing-pr…

You have to be within several layers of bubbles to not see how small a percent of the general population are going to even understand any of this BS.

Things being this complicated makes them a non-starter. A nerd vanity project.

And this isn’t a knock on the “intelligence” of the general population. They quite rightfully won’t want to spend their limited time on God’s earth learning about all this.

Re: Passkeys are now enabled by default for Google users

#448

Post by FireBeyond »

0cf8612b2e1e wrote: post #410
metafunctor wrote: post #390

Earlier quoted context omitted.

A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…

It sounds like I am up the creek if all of my devices are gone. With a bank, if I lose paperwork, they will have a process in place for me to prove my identity. BigTech will shrug if my phone-locked passkey becomes inaccessible.

100%.

The effort and hassle for Google et al to invest in robust support mechanisms (backend and people) for passkeys makes it highly unlikely.

No doubt you'll get the standard boilerplate email responses, if you are even that lucky, that just point you to an FAQ or something similarly unhelpful.

Re: Passkeys are now enabled by default for Google users

#449

Post by jjav »

jesseendahl wrote: post #376
crote wrote: post #301

Earlier quoted context omitted.

Yup! I've had similar complaints for years now. Modulo the whole privacy/vendor lockin issue, passkeys are not a terrible alternative to people without 2FA reusing the same basic password on every single website. However, when you actually rely on it to secure things , it quickly becomes a massive nightmare - made even worse by it being treated as equivalent to password+2FA.

> made even worse by it being treated as equivalent to password+2FA. passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are subject to phishing attacks. A passkey alone is much more secure than the vast majority of password + 2FA combinations. The only thing stronger than a passkey standing alone is a Security Ke…

> passkeys are significantly more secure

Blanket statements like this demonstrate a misunderstanding that "security" is just one thing in a single lineal scale.

In reality you have to ask, secure against what? And to answer that meaningfully you need to a thorough threat model for the specific use case of person P and account A.

The same person P will have a different threat model for every account they have.

The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria.

Re: Passkeys are now enabled by default for Google users

#450

Post by Tijdreiziger »

crooked-v wrote: post #229
qingcharles wrote: post #157

Earlier quoted context omitted.

I had a fire. I lost every single thing I own, except my landlord grabbed my phone, bless him. Otherwise I would have been totally stuck as all my TOTP apps are on there. Also, never lose your phone number. I can't get back into my Google account even though I have the username, password and recovery email because I can never get the SMS code.

> never lose your phone number The forced SMS 2FA that banks and credit card companies have started implementing infuriates me for exactly this reason.

That’s not so much a problem, because you can always go into a bank office and show ID.
Post reply on HN