I had a fire. I lost every single thing I own, except my landlord grabbed my phone, bless him. Otherwise I would have been totally stuck as all my TOTP apps are on there. Also, never lose your phone number. I can't get back into my Google account even though I have the username, password and recovery email because I can never get the SMS code.
Getting locked out of a Google account because I didn't have the number anymore happened to me too. Even though I had everything else even backup email verification, password, etc. Was a massive hassle.
So what is going to happen to those who were using U2F and then later on webauthn? If you registered, say, a Yubikey, many moons ago, on your Google account. Is this Yubikey now automagically going to become a "passkey"? Or will you have to choose between logging in with your Yubikey or with a new passkey? (say something Google controls, in your phone for example)
I just tried turning one of my yubikeys into a passkey on my google account to see what will happened. The response was that the device is not valid. I think they are keen on biometrics for their passkey implementation?
In general, the levels of security that people will increasingly need going forward, and the increasing requirement by companies to use that level of security, will be a usability pain for many people and a nightmare for at least a subset.
Is there any evidence that Google needs to mess with authentication flows? My mental model of the median Google account holder is that they have a bunch of photos/emails/docs/etc that are extremely valuable to them and their family, but of little value to criminals. With a dynamic like that, the security only has to be so high to deter random hackers and making it too difficult or confusing will ruin a lot of valid a…
There is incentive to gain access to personal emails. Not enough for spear phishing but enough for generic phishing. Access to email allows you to pivot to every online service in a person’s life.
As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…
Passkeys are one of the non-phishable means for authentication. If something is easy to recover for user then its same for a malicious actor. Some platform based passkeys (apple, google) are actually sync-able across the devices. The whole Passkeys concept is under debate and discussion for what it means for different types of WebAuthn authenticators when it comes to the ability to sync the credentials. Alternatively one can use security keys which they can keep with themselves and could protect themselves by enrolling one additional security key for recovery purposes that they can keep away. Regardless the whole idea is to have more than one MFA factors enrolled so that one is not get locked out. Ease of using WebAuthn/ Passkeys overweighs typing in password, SMS, TOTP codes and has big savings for big players to avoid phishing attacks. It might not be suitable for every use case but worth using for some.
A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…
What kinds of services would benefit from this level of security? I could see it being useful in corporate contexts (like locking down which machines are allowed to remotely control other machines), but not as much from a general consumer point of view.
At least with enterprise IT, or a bank etc you can pester them until they let you back in. They’ll have to sort it out eventually. That’s not going to work with Google or most web services.
Any web service that locks accounts to devices is going to be shedding customers as they lose or replace phones.
As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…
Not being able to regain access in exceptional cases is one of the big reasons why I am very weary about being forced to activate 2FA and other auth. It is so nice in theory... But the reality is that many users only use their phone to do almost everything digital in their life. My gf works for an assitive technology reseller. Since 2FA has been forced down the throats of unsuspecting users, she had to support several of their customers in regaining access to their Apple ID, noticing a few glitches in the supposed apple support path while at it. Phone hardware changes every few years. email addresses can change. And phone numbers can change. Combine all of them, and 2FA is suddenly no longer such a good idea... For reasonably sized companies, 2FA might be a good solution, because in case of you loosing access in some way, there is likely a support path that gets you back on track in reasonable amount of time, given that IRL auth is relatively simple. But for services where you are just a number, like every big provider, I believe a reasonably strong "master" password is still comforting to have.
> But not all setups support this. Some only allow one. Obvious issues abound. I'd go as far as to say "most setups don't support this. Most only allow one". The services I've seen so far that support multiple passkeys are in the minority.
Passkeys and u2f keys aren't the same. Systems must support multiple passkeys, otherwise you could only access the service from a single device, since passkeys are usually tied to a particular piece of hardware.
Nevertheless, nothing forces my banking app to accept a second PassKey other than the one linked to FaceID. When I buy a new phone, I need to re-bootstrap auth from zero. There’s no way to store two.
This is an interesting direction. It's worth noting that biometrics, like fingerprints or facial recognition, aren't really 'secrets'. They can be observed or leveraged without a users knowledge or consent, and in many ways function more like a username than a password.
Passwords are also not entirely secret, as they're shared by definition. Passkeys use public-private key crypto, which is more secure in every way.
Password should be stored as salted hash, so they are not really shared.
I'm surprised that they're moving forward with this already. As of last week, there were still enough rough edges on their implementation that I disabled it for my Workspace tenants. The two most irritating: 1. Advanced protection doesn't yet support passkeys. You must keep U2F in place for now. 2. If you have a U2F key configured on your account, Google will prompt you to use it as a passkey before telling you that…
> Android is also a problem here. Even in 14, it doesn't seem to support passwordless FIDO2 flows. Why would they? When Passkeys provide another opportunity for Google to lock-in their customers.
I probably could have framed this more clearly. I don’t think my point really supports the lock-in argument.
Google has been a big proponent of FIDO, having been an early adopter of U2F in Chrome and leveraging it for advanced protection. More recently, they have extended Chrome support to FIDO2/passkeys and made this move to make it the favored means of authentication for Google accounts.
Given that strategy, it’s a bit of a head scratcher to see Android lagging behind its desktop and mobile competitors. Why stick your mobile customers with second class support for the passwordless technologies you’re pushing everywhere else?!