Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

641–650 of 684 posts

Re: Passkeys are now enabled by default for Google users

#641

Post by blur13 »

KronisLV wrote: post #573
jjav wrote: post #432

Earlier quoted context omitted.

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more…

> People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). > And it comes with the benefit that you control…

You're gonna have a problem when you're on a trip abroad and lose your phone. Your only recourse is to go to the local internet cafe and log on to your email so you can send a message for help. Except you can't, because you dont know your password...

Re: Passkeys are now enabled by default for Google users

#642

Post by KronisLV »

blur13 wrote: post #641
KronisLV wrote: post #573

Earlier quoted context omitted.

> People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). > And it comes with the benefit that you control…

You're gonna have a problem when you're on a trip abroad and lose your phone. Your only recourse is to go to the local internet cafe and log on to your email so you can send a message for help. Except you can't, because you dont know your password...

> You're gonna have a problem when you're on a trip abroad and lose your phone.

There's also the possibility of bringing my netbook with me, which also could have a Nextcloud client setup (or Syncthing, or some cloud based option), same as every other device that I own, which would have the last offline backup of the file even if the server itself would blink out of existence.

Honestly a bigger problem without my phone would be the fact that I basically couldn't pay for things all that well when using a card, because of a redirect to my bank when making a purchase online (to confirm it), which then makes me use https://www.smart-id.com/ with a code to confirm it. That's kind of a problem because it's not TOTP but rather it's bound to the device.

I can work around the password safe issue with an SD card that has the database on it, or a USB stick as well, but that wouldn't work for the app, so in the modern day I'd basically need to have two phones, the same way someone might have two sets of keys to their apartment or something. Kind of crazy when you think about it. And I'd also need a smart card reader to even register a new account in most cases, in combination with my government issued ID card.

Re: Passkeys are now enabled by default for Google users

#643

Post by insanitybit »

0cf8612b2e1e wrote: post #636
insanitybit wrote: post #624

Earlier quoted context omitted.

> A fragile piece of hardware can fail me for a variety of reasons outside my control(lost or suddenly breaks). But you can use multiple devices... How is "a password written down and stored somewhere" better than a separate device used for backup purposes? Hell, get three devices, go nuts.

That does not seem like a big burden to the majority of the population? Many people have a single phone. That’s it. Everyone can write down a password without any troubles. This new and improved mechanism requires people to shell out real money for multiple devices just to be safe in case of loss/theft/failure? Let’s not forget the providers who do not offer the ability to enroll multiple devices. Last I heard, AWS w…

AWS is violating the spec and it's an embarrassment tbh

Anyway, to be clear, I'm not advocating for "get rid of passwords forever", I'm saying that for a lot of people passkeys are superior and the whole "how do I recover" is just not that big of a deal.

The main issue is the cost of devices like yubikeys. They should lower those. Companies should start providing them. Schools should hand them out. etc.

Re: Passkeys are now enabled by default for Google users

#644

Post by insanitybit »

Liquid_Fire wrote: post #640
insanitybit wrote: post #624

Earlier quoted context omitted.

> A fragile piece of hardware can fail me for a variety of reasons outside my control(lost or suddenly breaks). But you can use multiple devices... How is "a password written down and stored somewhere" better than a separate device used for backup purposes? Hell, get three devices, go nuts.

It's free and trivial to backup a password database any number of times. Even storing it with a cloud provider is nearly free, because they are so small. You can even automate verifying that all the backups are accessible and valid. When you create a new account with a new service, your daily backup will pick it up immediately. With passkeys you have to buy multiple phones, sign each of them into every one of your ac…

Phones? You can buy a yubikey

Re: Passkeys are now enabled by default for Google users

#645

Post by joshuamorton »

brnt wrote: post #615
joshuamorton wrote: post #613

Earlier quoted context omitted.

You still need my password or fingerprint to use a passkey, and can't transfer it from my device to yours.

Doesn't sound a whole lot different from TOTP to me.

You can't MITM a passkey, you can MITM a TOTP challenge.

That is, passkeys cannot be phished. The only way to get into my passkey protected account is to physically gain access to my passkey device, which requires both physical access to the device, and a second factor like a face/fingperprint or PIN/password.

Additionally, the TOTP secret can be copied, while today passkeys don't allow that either.

Re: Passkeys are now enabled by default for Google users

#646

Post by moogly »

sbuk wrote: post #575
moogly wrote: post #491

Earlier quoted context omitted.

Can't add those after the fact.

Sorry, but that is a weak argument. Individually, people have to take responsibility for their security. The tools exist and are simple to use.

It's not an argument, it's just reality.

Re: Passkeys are now enabled by default for Google users

#647

Post by Liquid_Fire »

insanitybit wrote: post #644
Liquid_Fire wrote: post #640

Earlier quoted context omitted.

It's free and trivial to backup a password database any number of times. Even storing it with a cloud provider is nearly free, because they are so small. You can even automate verifying that all the backups are accessible and valid. When you create a new account with a new service, your daily backup will pick it up immediately. With passkeys you have to buy multiple phones, sign each of them into every one of your ac…

Phones? You can buy a yubikey

What difference does it make? You still have all the same disadvantages.

Re: Passkeys are now enabled by default for Google users

#648

Post by jesseendahl »

jjav wrote: post #638
jesseendahl wrote: post #567

Earlier quoted context omitted.

Threat #1: Credential theft from server breaches Threat #2: User creates a weak credential Threat #3: User reuses a credential (uses same credential across multiple services) Threat #4: Phishing Attackers use huge password dumps compiled from multiple server breaches, and then try them against other services. Relying on a combination of the fruits of their labor from all four threats, attackers successfully compromis…

Password managers completely solve #3 and #4. They also largely solve #1, unless the leak happens from a company that stored them in cleartext or base64. But since the password was unique, it doesn't matter in practice except for that single backwater site so who cares. Not a threat. Password managers don't solve #4. But you left out the huge one, losing access to the account. Which for most people is a larger risk t…

>But you left out the huge one, losing access to the account.

Losing access to your passkey/password manager is a separate concern from the strength of the credential itself. Passkeys and passwords are just credentials. What you use to manage them is a separate concern. The concern about losing access to your passkey manager is super valid, but that same concern applies to all password managers that exist today. It's not a new concern that's specific or unique to passkeys. Yes, if you lose access to your password/passkey manager, then whatever solution you're using better have a great recovery story.

I know that at least both 1Password and iCloud Keychain have pretty great recovery flows. I am not sure about Google or the other password/passkey managers (I haven't looked into it deeply).

>of getting personally spearphished

100% agreed that most people don't need to worry about spear-phishing attacks. But that's (sadly) not super relevant, because many users fall for run-of-the-mill basic phishing attacks that any reader of HN would never fall for in a million years.

Re: Passkeys are now enabled by default for Google users

#649

Post by tharkun__ »

Nathanba wrote: post #474
tharkun__ wrote: post #467

Earlier quoted context omitted.

How do you secure 1Password? With a passkey? See the loop? Or a password? Wait, didn't we want to get rid of passwords? How is that any better? The kinds of people with reused passwords all over the place won't use 1Password. And if you do use 1password to actually generate strong passwords you don't need passkeys and it works on all kinds of services without those having to support passkeys.

it's better than a password because good passwords pretty much require to be generated by password managers in this day and age. Which means you can't actually remember them anyway, yet a password is still hackable or guessable Theoretically of course but not really, I've had some fairly long passwords of mine hacked somehow. I assume because a service stored them in plaintext and then got hacked. Make it 40 or 50 ch…

From the Last Pass blog about a recent incident:

    Cloud-based backup storage – contained configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data. All sensitive customer vault data, other than URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses, were encrypted using our Zero knowledge model and can only be decrypted with a unique encryption key derived from each user’s master password. As a reminder, end user master passwords are never known to LastPass and are not stored or maintained by LastPass – therefore, they were not included in the exfiltrated data.
https://blog.lastpass.com/2023/03/security-incident-update-r...

In other words, the thieves went to the bank vault a d stole your safety deposit box but can't access it because they need your key, which only you posses.

If I can store my passkeys in 1password (or lastpass etc) then nobody needs access to my physical phone. They just need access to my password manager's password.

I agree that for many many people password managers are way better than alternatives. But they don't magically make everything safe.

It's like MFA. "it is all safe now because we will send you a code via SMS" and the people fall for social engineering attacks that make them disclose the code the attacker just had the bank send to them.

I doubt such people will be a le to safely use a password manager or passkey for that matter. Passkey are just new enough that we have not had widespread news about how crooks were able to find the weak link(s). Probably on the human side again like in many cases.

Post reply on HN