Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

521–530 of 684 posts

Re: Passkeys are now enabled by default for Google users

#521

Post by varjolintu »

jxcl wrote: post #286
LeoPanthera wrote: post #255

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.

Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys. See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd... Re. your point about 1Password going down: Your passwords and pass…

If you consider KeePassXC to be one of the big players, they (will) support importing and exporting Passkeys.

Re: Passkeys are now enabled by default for Google users

#522

Post by dserodio »

rsync wrote: post #502
Whatever13 wrote: post #465

Earlier quoted context omitted.

I'm from Brazil, where as is known many robberies and assaults happen on the street, and ever since the whole process of putting essential life services into smartphones started, many people are adopting a scheme of having 2 smartphones (if not 3 or 4 for other reasons! ) : 1) The House smartphone → it is where you install everything truly vital, like the main bank app (started mainly because of this), 2FA apps like…

"... This phone NEVER NEVER leaves the house, except ONCE if the bank app requires on location authentication of the phone for the bank app to function ..." Can you elaborate ? What does this "on location" process look like ? What do they ask you to do ?

Not sure what he means, but some banking apps in Brazil have a "geofencing" feature like "only allow transactions when phone is inside this area". Presumably you set your home and work addresses as trusted.

Re: Passkeys are now enabled by default for Google users

#523

Post by pseudalopex »

noahtallen wrote: post #463
pseudalopex wrote: post #396

Earlier quoted context omitted.

> If you don't trust them, you're not forced to use them; traditional methods still exist. I predict this will not be true always.

Yes, the security industry is probably going to shift massively to Passkeys over the next few years. Phishing is a massive issue for enterprise security, and Passkeys basically completely fix it. IMO, this also means the problems with Passkeys will get fixed pretty quickly. And given I can already store my Passkey in 1Password and then use it on every device I currently use (including Firefox on mac/windows and iOS S…

> IMO, this also means the problems with Passkeys will get fixed pretty quickly.

Apple and Google do not quickly fix things when users have no alternative in my experience.

> And given I can already store my Passkey in 1Password and then use it on every device I currently use (including Firefox on mac/windows and iOS Safari), it's honestly not a huge problem.

For you. You believe the criticisms are dishonest?

Re: Passkeys are now enabled by default for Google users

#524

Post by two_handfuls »

jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

My understanding is that Passkeys are transferrable, unlike earlier efforts. See for example this iOS help page: https://support.apple.com/guide/iphone/passkeys-passwords-de...

Unless you store the passkey in a hardware Fido key like a Yubikey. Then the way to transfer it is to physically carry the key and plug it to another device.

Re: Passkeys are now enabled by default for Google users

#525

Post by drdaeman »

donmcronald wrote: post #318
leotravis10 wrote: post #298

Lauren Weinstein is sounding the alarm on passkeys which is flawed and that it would make a huge headache for a lot of people especilly normal folks. https://mastodon.laurenweinstein.org/@lauren/111103819626952... https://mastodon.laurenweinstein.org/@lauren/111211366080459...

It's not about security. It's about having a system for digital signatures that acts against the interests of the user.

The fundamental idea of using asymmetric cryptography to authenticate is good. It is time-proven, and it works in the best interests of users, simultaneously providing improved security. SSH just works (and while it typically lacks fancy UIs for key management, it's irrelevant to the core idea).

The passkeys design, though, has a number of obvious deficiencies and limitations. It is drastically better than ye olde but it's not a good standard.

The other alternative is SRP, but no browser vendor had bothered to do anything about this, so it remains a curiosity implemented on a couple websites (with all JS crypto gotchas, so - no good).

Re: Passkeys are now enabled by default for Google users

#526

Post by endgame »

stavros wrote: post #494
jjav wrote: post #432

Earlier quoted context omitted.

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more…

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

Why does this article claim that attestation is unlikely? We know Google loves the idea - see Web Environment Integrity (WEI).

Also, what's stopping us from falling into the passkey version of the world we got with OpenID, where many services force you to log in with your BigTech account?

Re: Passkeys are now enabled by default for Google users

#527

Post by Brajeshwar »

jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Ok. Now, I need to re-read and I’m tad worried.

I moved quite a bit of logins to Passkey and I chose to stay with the Apple ecosystem as my Passkey Lord/God. So far, it has worked and I have moved between devices (desktops, mobile, and the in-betweener).

Assuming I’m going to stay for quite a while with the Apple Ecosystem, am I doing it wrong by making my Passkeys pass through my Apple ID?

For instance, I change my eSim or number or replace phone, won't accept next time I login and then verify from the laptop, desktop, iPad, watch, or, heck, the Apple Polishing Cloth? (Assuming the cloth will become a smart cloth eventually).

Re: Passkeys are now enabled by default for Google users

#528

Post by jrockway »

jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

As with everything, you probably want a backup. Get more than one passkey.

I pretty much use 3; Yubikey in my workstation, portable Yubikey, phone. All 3 of those can bootstrap Google, which I use for email, and Apple, which I use for my phone. Then, everything else is in 1password, which are available through those mediums. Worst case, I am pretty sure in the most dire of dire emergencies, I can get my email back no matter what. Verify ID with my DNS provider, switch MX records, back in business. Even then, it's not necessarily essential to daily life. (A colossal inconvenient to lose access? For sure. Death sentence? Probably not.) All my SMS and Signal contacts are elsewhere. I can spend money out of my bank account by writing a check. I can get into work stuff by showing up in person at an office.

I do think that passkeys are probably too complicated for the ordinary user of computers; unfortunately that "we'll just email you a link every single time you want to sign in" seems like the most user-friendly passwordless authentication.

I also don't feel great about my habit of putting passkeys in 1password, because I know I'm locked in forever. But, I like the service, and when I want to switch, welp, at least there's a list of accounts I have to remake.

My biggest fear is something like forgetting my phone's passcode. One time I woke up, got distracted at just the wrong moment, and could not for the life of me remember my 6 digit passcode. (I also use the same code to unlock my workstation.) I had to distract myself and then use muscle memory to remember it. It was really crazy, truly one of those "did I just have a stroke" moments. I have that saved in 1password now, so if I have one unlocked device, I can refresh my memory. This happened a while ago and I don't think I have dementia. Just a weird quirk.

(Meanwhile, I can perfectly remember every 1-year-max-lifetime password I've ever had at any job. A lot of that good does when you can't remember a 6 digit number!)

Re: Passkeys are now enabled by default for Google users

#529

Post by lcnPylGDnU4H9OF »

endgame wrote: post #526
stavros wrote: post #494

Earlier quoted context omitted.

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

Why does this article claim that attestation is unlikely? We know Google loves the idea - see Web Environment Integrity (WEI). Also, what's stopping us from falling into the passkey version of the world we got with OpenID, where many services force you to log in with your BigTech account?

> Why does this article claim that attestation is unlikely?

Facebook is still going to want me on their websites even if I’m running Firefox. Most websites people visit will not do any chrome WEI attestation. Likely exceptions are sites which handle any legal, financial, or health-related data. Not credit cards. I doubt most Google properties will use WEI.

They still want to slurp up all my juicy Firefox usage data and I bet they think a lot of such users will drop their services like a rock if it meant otherwise dropping their browser.

Re: Passkeys are now enabled by default for Google users

#530

Post by bhawks »

jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

The solution to your problem is simply more passkeys.

I am not being sarcastic - which ever service your authenticating to make sure you have passkeys from at least 2 different devices so you do not lock yourself out.

If you don't fit into this multi device assumption, passkeys are not going to work well for you. There will not be a standard for transfer / recovery.

Post reply on HN