Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

581–590 of 684 posts

Re: Passkeys are now enabled by default for Google users

#581

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

An eSIM isn't a cryptographic secret you need to backup its provisioned by your carrier.

It is quite literally a virtual Smart Card stored in a TPM chip. It has a private key in a hardware device, making it a cryptographic secret.

Re: Passkeys are now enabled by default for Google users

#582
post #407

Earlier quoted context omitted.

> Nobody should be using a remembered password anymore. Nobody is a strong number, why? I don't want to use biometrics for logging in to my SSH terminal. I dislike having to use my phone for authentication methods. I go many places without my phone. Even tempted to gon on holiday without it. Maybe I'm just one of the few who actually enjoys turning it off when coding, developing or whatever.

Not wanting to use biometrics directly for over-the-web authentication is one thing. Not taking the time to understand the technology being employed by Passkeys is entirely another. That’s your fault.

> That’s your fault.

No one's explained it to me. Other than "DoNT UsE PaSsWoRds", that's not my fault.

Why should I have to learn it, why should my mother have to learn it. This an a totally thrown in your face situation.

Theres plenty of posts in this thread explaining to why its a flawed design. You tell me why not.

Re: Passkeys are now enabled by default for Google users

#583

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Pretty sure apple makes you sign a paper saying that you agree to the device being wiped.

Re: Passkeys are now enabled by default for Google users

#584
post #407

Earlier quoted context omitted.

Not wanting to use biometrics directly for over-the-web authentication is one thing. Not taking the time to understand the technology being employed by Passkeys is entirely another. That’s your fault.

> That’s your fault. No one's explained it to me. Other than "DoNT UsE PaSsWoRds", that's not my fault. Why should I have to learn it, why should my mother have to learn it. This an a totally thrown in your face situation. Theres plenty of posts in this thread explaining to why its a flawed design. You tell me why not.

There are plenty of posts in this thread that are misrepresenting the technology, in a few cases deliberately. If you feel strongly enough to comment, you owe it to yourself and the discussion to go to the source and understand what it's about - that's what I mean by that's your fault. You clearly understand enough to A) argue against biometrics over the wire and B) feel you can comment on Passkeys.

Most, if not all (I've not read every post) of the 'flaws' mentioned generally exist in computer security; for example, no one is impervious to a thug and a weapon. The implementation is as simple as generating a key pair; the private key is stored in a secure enclave, either on device or in a secure location, and the public key is shared with the 3rd party. All services provide some recovery method upfront, clearly stating the importance of a backup. There is only so much they can do before you accept the responsibility for managing your security and privacy online. Resorting to "won't someone think of the children" doesn't help either. My mother, who is 74, has no problem with passkeys.

Is it perfect? No. There are 'better' competing standards, but they don't have anywhere near the consensus of the broader security field. Is it better than the current status quo? Definitely. Public key cryptography is significantly better than username/password combinations, even with TOTP or HTOP second factors, though ultimately, it will be a while before they disappear.

Re: Passkeys are now enabled by default for Google users

#585
post #286

Earlier quoted context omitted.

Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys. See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd... Re. your point about 1Password going down: Your passwords and pass…

If you consider KeePassXC to be one of the big players, they (will) support importing and exporting Passkeys.

...and if i understand correctly, websites can dictate whether they allow KeePassXC (or any other specific vendor) to store their passkey.

In other words, if a website doesn't like that their passkeys can be exported, they can block KeePassXC.

Re: Passkeys are now enabled by default for Google users

#586

Earlier quoted context omitted.

Passkeys follow the 3-2-1 backup rule, just like any other digital data. The main difference being that you don't need to backup the passkey itself, just have multiple passkeys. Have 3 passkeys 2 of them on-person at any time (e.g. one on your phone TPM, one on a Yubikey) 1 of them off-site (e.g. keep a backup Yubikey at home in a fireproof safe, or use a 1Password passkey, depending on your threat model) Whenever yo…

I do follow this. Unfortunately, it leaves out one glaring flaw: you can’t register a Passkey you don’t physically have. I use four: an Apple Passkey, a YubiKey I keep on me, a YubiKey at home, and a YubiKey in the bank. When I sign up for a service, I need to register all four of them. Not only is this generally a bit of a pain in the ass, but it also means I have to remember to go fetch the one in the bank vault pe…

> I have to remember to go fetch the one in the bank vault periodically

I feel you, but I don't think Average Joe's threat model requires keeping a Yubikey in a safe deposit box (this is besides the issue that safe deposit boxes are less safe than you think: https://www.nytimes.com/2019/07/19/business/safe-deposit-box... ). A cloud-based passkey (like 1Password) is fine as the off-site backup key for most people.

Re: Passkeys are now enabled by default for Google users

#587
post #286

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.

Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys. See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd... Re. your point about 1Password going down: Your passwords and pass…

> "If 1Password becomes unreachable for any reason, you still have access to everything in your vaults"

Temporarily, i guess? Since it's not stored in an open format?

Is this not bound to some sort of "Secure Enclave" or whatever, and won't survive a reinstall / restore / etc. ?

Re: Passkeys are now enabled by default for Google users

#588
post #458
post #432

Earlier quoted context omitted.

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more…

Just like the rest of it, they’re going to try to lock down the open web, general-purpose computing, etc. They are going to be the gatekeepers if you and the web services let them. Oh yeah — also they’ll run all the web, email and other services anyway. Trap you in their metaverse and AI most likely, since that’s where your coworkers and friends will be you’ll have to be there too. Resist by opting out :)

Contrary to popular belief Google doesn't run email. It more or less does so in the US, but only there people were so enthusiastic to jump onto their platform. Probably a result of other US alternatives being that bad.

But in many other countries, gmail isn't that successful. Still, email is still under attack by big mail servers getting more and more restrictive.

Re: Passkeys are now enabled by default for Google users

#589
post #442

Earlier quoted context omitted.

Why is a piece of paper not a piece of hardware? We do this for TOTP too as a last resort, nothing wrong with that.

Totp is phishable. Passkeys aren't phishable. At the point where the user can access the private keys phishing is once again a concern. If I can't access my pk, I cannot be phished. As soon as you allow me to copy my key (instead of creating many, which should be acceptable) I can be phished again.

Passkeys are stealable no? If I have you phone...

Re: Passkeys are now enabled by default for Google users

#590

Earlier quoted context omitted.

It sounds like I am up the creek if all of my devices are gone. With a bank, if I lose paperwork, they will have a process in place for me to prove my identity. BigTech will shrug if my phone-locked passkey becomes inaccessible.

The initial poster described that process - you bring government IDs in person to an office. If you want to avoid that, just set up multiple devices.

Or use a password. Seriously, you have to do better here. I guess we will see recovery options by a master password and then the mechanism would be the question again.
Post reply on HN