Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

501–510 of 684 posts

Re: Passkeys are now enabled by default for Google users

#501

Post by RockRobotRock »

jjav wrote: post #432
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more…

Non-tech people have a fundamental misunderstanding of what makes a good password, and stupid IT policies like password expiration lead to really bad habits like frequently forgetting passwords, frequently reusing passwords, and end with writing it down on a post-it note.

Re: Passkeys are now enabled by default for Google users

#502

Post by rsync »

Whatever13 wrote: post #465
verytrivial wrote: post #248

Earlier quoted context omitted.

Disaster recovery. This is 100% my biggest worry with 2FA/MFA. I also think this is one of the reasons stuff like PGP never took off (don't @ me regarding perfect forward secrecy): the problem has always been managing some little, precious thing and the ramifications of what happens if it put beyond use or is used by some bad actor.

I'm from Brazil, where as is known many robberies and assaults happen on the street, and ever since the whole process of putting essential life services into smartphones started, many people are adopting a scheme of having 2 smartphones (if not 3 or 4 for other reasons! ) : 1) The House smartphone → it is where you install everything truly vital, like the main bank app (started mainly because of this), 2FA apps like…

"... This phone NEVER NEVER leaves the house, except ONCE if the bank app requires on location authentication of the phone for the bank app to function ..."

Can you elaborate ?

What does this "on location" process look like ? What do they ask you to do ?

Re: Passkeys are now enabled by default for Google users

#503

Post by rsync »

j1elo wrote: post #470
qingcharles wrote: post #354

Earlier quoted context omitted.

And what do you do when you go abroad and a web site says "Oh, looks like you are logging in from a new location - please check your SMS for a PIN now" :(

Use an SMS mule like the one described by https://news.ycombinator.com/item?id=28251107 I use "SMS Gate", an open source app available on F-Droid: https://f-droid.org/en/packages/com.github.axet.smsgate/

Here's a better write-up I did:

https://kozubik.com/items/2famule/

Re: Passkeys are now enabled by default for Google users

#504

Post by vel0city »

toomuchtodo wrote: post #64
ses1984 wrote: post #31

Earlier quoted context omitted.

If you can recover an account without the passkey, how much security is it really adding?

Depends on the recovery mechanism. Providing a government credential with a live selfie is the gold standard. If a company doesn't support that, they're being cheap at the cost of security (you can perform such an identity proof for ~$1-2/per successful proof through a vendor like Stripe Identity or ID.me). Passkeys solves for digital identity compromise (credential theft or stuffing/spraying), but you must rely on o…

How do I actually give them my real government document with it's physical security features through the internet? Just take a grainy photo of it? Really secure!

Re: Passkeys are now enabled by default for Google users

#505

Post by hedora »

Can we decide to band together as an industry and call this “zero factor authentication,” since you login without using something you know or something you own/control?

The only way I can think of to explain this to a non-techie is “your account is now tied to your [singular] device, and neither a password nor a replacement device (like a new sim card) will let you in.”

So, it really does remove both factors from 2FA, and the logical conclusion holds.

Either anyone can get into an account with a “I broke my phone” social engineering attack, or the account owner cannot reliably authenticate.

Re: Passkeys are now enabled by default for Google users

#506

Post by echeese »

hedora wrote: post #505

Can we decide to band together as an industry and call this “zero factor authentication,” since you login without using something you know or something you own/control? The only way I can think of to explain this to a non-techie is “your account is now tied to your [singular] device, and neither a password nor a replacement device (like a new sim card) will let you in.” So, it really does remove both factors from 2FA…

Something you have: Your phone

Something you know: Your pin

Something you are: Your FaceID/Fingerprint

Re: Passkeys are now enabled by default for Google users

#507

Post by 90-00-09 »

stavros wrote: post #494
jjav wrote: post #432

Earlier quoted context omitted.

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more…

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

How does this address OP's concern? If you have a single device (e.g. an iPhone) and you store all your passkeys on it, then losing it means you lost all passkeys. Your post describes exactly that:

- "I can’t recover the keys if I lose the hardware"

- "That is a risk you’ll need to take if you’re using hardware authenticators"

Fantasizing that with this proposed simplification of the authentication process people will introduce complexities such as a password manager or a backup hardware device is naive to say the least.

Re: Passkeys are now enabled by default for Google users

#508

Post by hedora »

rawgabbit wrote: post #226

While I believe this is a step in the right direction. I have read too many horror stories of people who were locked out of their Google and iCloud accounts with no real possibility of getting back in. I don’t think I am alone in thinking I am on borrowed time. Someday, probably due to my own fault I will be locked out of Google and my digital life will be over. If a private company can offer a similar login method l…

I haven’t heard of people getting locked out of iCloud. Losing all your devices nukes E2EE stuff, but that’s not much stuff by default. In particular, photos, device backups and messages are recoverable.

I thought the Apple Store would check your driver’s license or whatever and reset your password, recovering whatever is protected by the escrow keys.

I know Google loses accounts all the time, mostly thanks to “surprise 2FA” combined with zero tech support. I’d believe Apple screws this up too, but I haven’t heard any anecdotes.

Care to share a link to examples?

Re: Passkeys are now enabled by default for Google users

#509

Post by stavros »

90-00-09 wrote: post #507
stavros wrote: post #494

Earlier quoted context omitted.

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

How does this address OP's concern? If you have a single device (e.g. an iPhone) and you store all your passkeys on it, then losing it means you lost all passkeys. Your post describes exactly that: - "I can’t recover the keys if I lose the hardware" - "That is a risk you’ll need to take if you’re using hardware authenticators" Fantasizing that with this proposed simplification of the authentication process people wil…

I haven't heard anyone claim that passkeys are simpler than passwords, as that would be trivially false. The claim is that they're more secure while still remaining fairly usable.

Passkeys are WebAuthn credentials that are synced between devices, so they aren't hardware keys, they're software keys.

Re: Passkeys are now enabled by default for Google users

#510

Post by josephcsible »

stavros wrote: post #494
jjav wrote: post #432

Earlier quoted context omitted.

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more…

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

That article is about as misleading as it's possible to be while still being technically right. The "attestation" feature of passkeys exists solely to let websites refuse to let you use passkeys tied to hardware you do control, or to software. The way this article only mentions it in passing and tries to downplay it reminds me of the joke of https://what-if.xkcd.com/49/ - a very long article listing a bunch of upsides of the Sun going out, and only one sentence about the downside: "We would all freeze and die."
Post reply on HN