Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

401–410 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#401

Post by guenthert »

psychphysic wrote: post #337
moffkalast wrote: post #305

Earlier quoted context omitted.

From what I can find the word passkey is just a synonym for password. So yes, none of this makes any sense.

It makes sense if you want to move from two factor authentication to just the second factor while making it seem new and cool? It seems to be smoke and mirrors for you register a bunch of TPM/HSM.

Don't be so quick to dismiss it. Afaiu, (one of) the problems they intend to address is the (all too common) case of breach of security at the server where large number of passwords are stolen. The public part of a passkey, i.e. the one stored on the server, is worthless to an adversary.

Re: Passkeys: The beginning of the end of the password

#402

Post by themagician »

hedora wrote: post #183
signal11 wrote: post #161

Earlier quoted context omitted.

My cynical assessment of Passkeys is: If Google/Amazon/Apple/Meta/whoever locks your account out, you now lose access everywhere. This isn’t a theoretical risk. You’ll see lots of people complain about this online. Also, Passkey providers now get sweet sweet metadata about your accounts around the web. But yeah, authn is hard to do right. Equally, asking your users to fall into $BIG_PROVIDER’s arms seems wrong. My pe…

Agreed. This whole thing seems incredibly user hostile. At the very least, there should be severe legal recourse (criminal liability and also large, material-to-earnings statutory damages) if one of these providers intentionally locks you out of a third-party account. That third party account should be treated like your personal property, and them denying you access to it should be treated like their CEO breaking int…

Lol. If something does happen Google will immediately and repeatedly remind you with every communication that they have no liability. Once your account gets flagged or locked, Google adds the following to damn near every email:

“We have concluded the review of the information you’ve submitted. To prevent possible fraud and abuse, your services will remain suspended. It is our policy to not discuss the specific reasons for these suspensions.

Note that in the Google Terms of Service, we reserve the right to change, suspend, or discontinue any aspect of our services at any time, including availability of a service or any feature, without notice and without liability. We also reserve the right to impose limits on certain Service features or restrict access to some or all of the Services without notice and without liability.”

Re: Passkeys: The beginning of the end of the password

#403

Post by jiggawatts »

I keep hearing a lot of talk about Passkeys, but I haven't yet seen any web site, service, platform, or cloud where I could actually use one.

Has anyone used these in the field for a major, popular site or product? What was it?

More importantly: What if I have a Windows laptop and an iPhone? Can I transfer a Passkey from my "only Apple device" to something else as a backup, or will these be locked to one vendor?

Re: Passkeys: The beginning of the end of the password

#404

Post by brokenmachine »

shadowgovt wrote: post #328
Dalewyn wrote: post #312

Earlier quoted context omitted.

Passwords will never be supplanted unless the new challenger can satisfy all of the following: * Easy to understand. (A password is just a word/phrase/string of characters only you know.) * Easy to use. (Using a password only requires remembering and typing it in when prompted.) * Convenient. (Only your ability to remember and type required. No other tools or gadgets required.) * Simple. (All of the above.) If someth…

I'm actually going to set this up on my mother-in-law's machine next time I see her. She's forever losing her book of passwords, but always has her phone on her.

That'll be fun when she drops her phone in the toilet.

Re: Passkeys: The beginning of the end of the password

#405

Post by mr_toad »

esquivalience wrote: post #378
__MatrixMan__ wrote: post #370

Earlier quoted context omitted.

Why not call it a private key then, we've been handling those since the 70's. They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.

Why not call passwords private words? We've been using words even longer. The answer is that they're being used to pass an authentication challenge. Pass + key is no different.

I guess because historically (before computers) passwords were often shared. Even now a password doesn’t technically need to be private.

Re: Passkeys: The beginning of the end of the password

#407

Post by dahwolf »

Dalewyn wrote: post #312
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

Passwords will never be supplanted unless the new challenger can satisfy all of the following: * Easy to understand. (A password is just a word/phrase/string of characters only you know.) * Easy to use. (Using a password only requires remembering and typing it in when prompted.) * Convenient. (Only your ability to remember and type required. No other tools or gadgets required.) * Simple. (All of the above.) If someth…

I would add portable (which passkeys are not) and recoverable (which passkeys are not, in the worst case).

Re: Passkeys: The beginning of the end of the password

#408

Post by dahwolf »

shadowgovt wrote: post #321
berkle4455 wrote: post #310

Earlier quoted context omitted.

It’s a password that Google controls so when they incorrectly ban you from their services you lose access to literally everything. Or if you drop your phone in a lake you’re out of luck too.

It's the second one, not the first one. The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth. (Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone…

"best have another way to auth"

right, so passwords it is then.

Re: Passkeys: The beginning of the end of the password

#409

Post by jacooper »

internetter wrote: post #397
mastazi wrote: post #386

Earlier quoted context omitted.

So it's like a private key but you can't access or manage it, as it's owned by Google/Apple/Microsoft? How convenient!

My reaction as well. From Google's FAQ: > Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager. I don't like this. Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration. I certainly don't like the lack of emphasis on…

AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly.

Also it seems that Linux is completely out of the picture.

Post reply on HN