Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bringing passkeys to Android and Chrome

android-developers.googleblog.com

Post reply on HN
Print view View original

21–30 of 264 posts

Re: Bringing passkeys to Android and Chrome

#21

Post by jackson1442 »

jrm4 wrote: post #8

Nah. For all the talk of "one app to rule them all" (which is an awful idea) this is a step closer to that. For all it's faults, crypto has one thing right -- not your keys, not your stuff. I get that doing keys/passwords is hard, but the best thing in the long run is for them to stay in the hands of the user. And if not, the holder of the keys needs to be someone you can easily hold accountable, i.e. either fire, or…

it is your key, it lives on your device (and is synced across devices using your cloud account if you so choose)

Re: Bringing passkeys to Android and Chrome

#22

Post by greatgib »

selykg wrote: post #15
greatgib wrote: post #10

Another product that they will use their dominant position to force down our throat!

This is all part of the FIDO Alliance, so, a standards based solution that anyone with the wherewithal to implement it can do so. Many password managers have already said they'll be supporting it, as well as major vendors (Google and Apple for instance). I'm struggling to see your complaint being a valid one. This is basically webauthn, so use a Yubikey or similar device if you wish.

Remember how gmail was just imap/smtp? etc...

Re: Bringing passkeys to Android and Chrome

#24

Post by EvanAnderson »

toomuchtodo wrote: post #18
sowbug wrote: post #16

Earlier quoted context omitted.

From TFA (the security blog): "The main ingredient of a passkey is a cryptographic private key. In most cases, this private key lives only on the user's own devices, such as laptops or mobile phones."

Final step is key escrow authority that will store your private key and produce it to you if you can proof your identity with government ID. It is not enough to store in cloud storage (which Google, Apple, or someone else could deny you access to), or your own device you could lose or destroy (which is why backup hardware tokens are always recommended for U2F MFA); you need the ability (but not a requirement) to bind…

In the United States the US Postal Service would be a great fit for a job like this. They already have good infrastructure for identity verification and physical distribution.

I wouldn't want escrow of private keys, however. I'd rather the USPS just act as a certification authority that provides strong guarantees of identity verification.

Re: Bringing passkeys to Android and Chrome

#26

Post by toomuchtodo »

EvanAnderson wrote: post #24
toomuchtodo wrote: post #18

Earlier quoted context omitted.

Final step is key escrow authority that will store your private key and produce it to you if you can proof your identity with government ID. It is not enough to store in cloud storage (which Google, Apple, or someone else could deny you access to), or your own device you could lose or destroy (which is why backup hardware tokens are always recommended for U2F MFA); you need the ability (but not a requirement) to bind…

In the United States the US Postal Service would be a great fit for a job like this. They already have good infrastructure for identity verification and physical distribution. I wouldn't want escrow of private keys, however. I'd rather the USPS just act as a certification authority that provides strong guarantees of identity verification.

Yes, definitely. USPS + Login.gov could act as trust anchors, with cryptographic keys reprovisioned upon proofing, versus storing them. I am open to whatever is the optimal balance between security and practicality.

https://www.uspsoig.gov/document/role-postal-service-identit...

> The Postal Service Reform Act of 2022 has recently expanded the Postal Service’s ability to provide identity verification to all levels of government. A window of opportunity is currently open for USPS to contribute to closing gaps in government identity verification processes.

Re: Bringing passkeys to Android and Chrome

#27

Post by wnevets »

Passkeys sound like another way for companies like Google and Apple to lock you into their walled garden. Having each walled garden randomly generating a key for every single domain instead of using the actual domain name as part of the key is a great way to lock regular people into their respective ecosystems.

Re: Bringing passkeys to Android and Chrome

#28

Post by fotta »

Google's auth is getting increasingly frustrating. Recently when I logged in with TOTP 2FA, I had to also open up YouTube on another device and click approve. What's the point of 2FA if they're just going to ignore it?

Re: Bringing passkeys to Android and Chrome

#29

Post by stevewatson301 »

selykg wrote: post #15
greatgib wrote: post #10

Another product that they will use their dominant position to force down our throat!

This is all part of the FIDO Alliance, so, a standards based solution that anyone with the wherewithal to implement it can do so. Many password managers have already said they'll be supporting it, as well as major vendors (Google and Apple for instance). I'm struggling to see your complaint being a valid one. This is basically webauthn, so use a Yubikey or similar device if you wish.

You'll be out of luck when trying to switch from one ecosystem to another (for example, from Apple to Google).

Re: Bringing passkeys to Android and Chrome

#30

Post by olliej »

megous wrote: post #20
sowbug wrote: post #16

Earlier quoted context omitted.

From TFA (the security blog): "The main ingredient of a passkey is a cryptographic private key. In most cases, this private key lives only on the user's own devices, such as laptops or mobile phones."

"Passkeys on users’ phones and computers are backed up and synced through the cloud to prevent lockouts in the case of device loss." "Only on the user's device", right.

They way keys are managed means that the passkey material is never available to Google, Apple, etc
Post reply on HN