Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

651–660 of 684 posts

Re: Passkeys are now enabled by default for Google users

#651

Post by MrDrMcCoy »

metafunctor wrote: post #391
brundolf wrote: post #382

Earlier quoted context omitted.

Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue

The point is that the private key resides on a tamperproof piece of hardware. Malware, viruses, or shoulder surfers cannot copy the key. The solution is to set up multiple pieces of secure hardware, not writing down the keys to the castle on a piece of paper.

How many of those devices do you think people are willing to buy, keep updated, AND store off site? A fire, car accident, flood, or major theft could wipe multiple devices out in one fell swoop. Unless there's a secure way to make passkeys portable and able to be backed up in a secure manner off-site, I will avoid this tech like the plague.

Re: Passkeys are now enabled by default for Google users

#652

Post by buggyipadmettoo »

blur13 wrote: post #641
KronisLV wrote: post #573

Earlier quoted context omitted.

> People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). > And it comes with the benefit that you control…

You're gonna have a problem when you're on a trip abroad and lose your phone. Your only recourse is to go to the local internet cafe and log on to your email so you can send a message for help. Except you can't, because you dont know your password...

Solution: use a memorable password for one of your cloud services. One that does not require 2FA. Keep a copy of password db there.

Re: Passkeys are now enabled by default for Google users

#653

Post by Nathanba »

tharkun__ wrote: post #649
Nathanba wrote: post #474

Earlier quoted context omitted.

it's better than a password because good passwords pretty much require to be generated by password managers in this day and age. Which means you can't actually remember them anyway, yet a password is still hackable or guessable Theoretically of course but not really, I've had some fairly long passwords of mine hacked somehow. I assume because a service stored them in plaintext and then got hacked. Make it 40 or 50 ch…

From the Last Pass blog about a recent incident: Cloud-based backup storage – contained configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data. All sensitive customer vault data, other than URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses, were encrypted using our Zero knowledge model…

well I really thought that the whole point of passkeys was that they are tied to the device. Syncing a passkey should have only meant that you have a backup, not that you can actually log in from a totally different device with that other device's passkey...

Re: Passkeys are now enabled by default for Google users

#654

Post by MrDrMcCoy »

bhawks wrote: post #530
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

The solution to your problem is simply more passkeys. I am not being sarcastic - which ever service your authenticating to make sure you have passkeys from at least 2 different devices so you do not lock yourself out. If you don't fit into this multi device assumption, passkeys are not going to work well for you. There will not be a standard for transfer / recovery.

Not just multiple devices, but multiple locations. A fire, flood, car accident, or theft can result in the total loss of multiple devices unless one is sufficiently far away and also secure. Then there's keeping that remote device up to date. This is beyond the patience, finance, and understanding of virtually everyone.

Re: Passkeys are now enabled by default for Google users

#655

Post by 90-00-09 »

stavros wrote: post #614
90-00-09 wrote: post #612

Earlier quoted context omitted.

Here is Google discussing how passkeys are easier and simpler to use than passwords: https://security.googleblog.com/2023/05/making-authenticatio... Here is 1Password discussing how passkeys are simpler to use than passwords: https://1password.com/product/passkeys Here is Ars Technica declaring that passkeys are easier to use than passwords: https://arstechnica.com/information-technology/2023/05/passw... Etc etc. If…

Oh huh, I stand corrected. I thought passwords were easy, but, thinking about it, I've had lots of trouble trying to figure out which password I've used for each site. I can definitely believe passkeys are easier, in light of that.

Personally I think that’s the best selling point of passkeys. Most non-tech people don’t use password managers and have to memorize passwords, reset frequently passwords they can’t remember, etc. Security is way harder to sell than convenience.

Saying that, I am struggling to understand what is the expectation for ordinary user behavior in terms of hardware-tied credentials. Eg so many people upgrade their iPhone every 1-2 years. If passkeys are not transferred to the new phone, what is the industry suggesting people do?

Re: Passkeys are now enabled by default for Google users

#656

Post by stavros »

90-00-09 wrote: post #655
stavros wrote: post #614

Earlier quoted context omitted.

Oh huh, I stand corrected. I thought passwords were easy, but, thinking about it, I've had lots of trouble trying to figure out which password I've used for each site. I can definitely believe passkeys are easier, in light of that.

Personally I think that’s the best selling point of passkeys. Most non-tech people don’t use password managers and have to memorize passwords, reset frequently passwords they can’t remember, etc. Security is way harder to sell than convenience. Saying that, I am struggling to understand what is the expectation for ordinary user behavior in terms of hardware-tied credentials. Eg so many people upgrade their iPhone eve…

Passkeys are Google-synced WebAuthn keys, so there's no such thing as hardware-tied passkeys. If you want to use hardware WebAuthn keys, you should know what you're doing.

Re: Passkeys are now enabled by default for Google users

#657

Post by MrDrMcCoy »

jesseendahl wrote: post #389
hbt wrote: post #371

Earlier quoted context omitted.

what you are describing is why I use a virtual phone for all services. you can do it on your own with twilio, then create a phone number and have a program forward you stuff to your real phone. the twilio phone is hard to lose as it has an api and you can toss it when you want to start over. except now, you need an entire phone virtualized as your proxy instead of just a twilio phone number. they keep raising the bar…

This provides significantly weaker account security than using a passkey. 2FA codes delivered over SMS can be phished.

Tell that to my bank :(

Re: Passkeys are now enabled by default for Google users

#658

Post by MrDrMcCoy »

Whatever13 wrote: post #465
verytrivial wrote: post #248

Earlier quoted context omitted.

Disaster recovery. This is 100% my biggest worry with 2FA/MFA. I also think this is one of the reasons stuff like PGP never took off (don't @ me regarding perfect forward secrecy): the problem has always been managing some little, precious thing and the ramifications of what happens if it put beyond use or is used by some bad actor.

I'm from Brazil, where as is known many robberies and assaults happen on the street, and ever since the whole process of putting essential life services into smartphones started, many people are adopting a scheme of having 2 smartphones (if not 3 or 4 for other reasons! ) : 1) The House smartphone → it is where you install everything truly vital, like the main bank app (started mainly because of this), 2FA apps like…

Even that doesn't seem like enough to me. You need not just multiple devices, but multiple distant locations. A fire, flood, car accident, or theft can result in the total loss of multiple devices unless one is sufficiently far away and also secure. Then there's keeping that remote device up to date. This is beyond the patience, finance, and understanding of virtually everyone.

Re: Passkeys are now enabled by default for Google users

#659

Post by mwwaters »

raxxorraxor wrote: post #591
negative_zero wrote: post #532

Earlier quoted context omitted.

Completely agree. Currently I can perform a full bootstrap using information stored in my brain (with my partner's brain as backup). Any new "solution to passwords" that doesn't allow that means an instant NO from me. I don't care how much more theoretically secure it is.

It isn't more secure if you use a secure password with the standard way of auth today. Especially not theoretically what relates to cryptography. Some common attack vectors like phishing would be more secure since you more or less automatically generate different credentials for different services, just as you get different access tokens from your oauth service. Token theft is an issue too, but only ever partially co…

Having different passwords doesn't prevent phishing where you think you're logging into the service being phished. The hacker would also create a new TOTP on that service once they get in to that service.

Re: Passkeys are now enabled by default for Google users

#660

Post by mwwaters »

solatic wrote: post #536
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

Passkeys follow the 3-2-1 backup rule, just like any other digital data. The main difference being that you don't need to backup the passkey itself, just have multiple passkeys. Have 3 passkeys 2 of them on-person at any time (e.g. one on your phone TPM, one on a Yubikey) 1 of them off-site (e.g. keep a backup Yubikey at home in a fireproof safe, or use a 1Password passkey, depending on your threat model) Whenever yo…

I will say that for Google's Advanced Protection, I was convinced having a recovery phone added was okay.

I just have a hardware key on my key chain and one on a pretty fireproof safe (which I got for other reasons). But I still added a phone recovery just in case.

As I understand it, the recovery process will always wait multiple days while sending many emails to me that it's been initiated.

Post reply on HN