Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bringing passkeys to Android and Chrome

android-developers.googleblog.com

Post reply on HN
Print view View original

51–60 of 264 posts

Re: Bringing passkeys to Android and Chrome

#51

Post by selykg »

stevewatson301 wrote: post #29
selykg wrote: post #15

Earlier quoted context omitted.

This is all part of the FIDO Alliance, so, a standards based solution that anyone with the wherewithal to implement it can do so. Many password managers have already said they'll be supporting it, as well as major vendors (Google and Apple for instance). I'm struggling to see your complaint being a valid one. This is basically webauthn, so use a Yubikey or similar device if you wish.

You'll be out of luck when trying to switch from one ecosystem to another (for example, from Apple to Google).

This is really no different between switching hardware devices.

Step 1. Sign in using your existing device

Step 2. Add your new device

Step 3. Remove your old device (or keep it for a backup)

And if you feel that's going to be a big issue for you, use a 3rd party software based tool like Bitwarden, 1Password, or other tools that have indicated they'll be supporting this. That info will sync between those software based tools and allow you to use whichever devices you wish, across multiple platforms with minimal effort.

Re: Bringing passkeys to Android and Chrome

#52

Post by alyandon »

account-5 wrote: post #36

I don't use my phone to log in to anything. All my stuff is done on a computer with a password manager. At no time am I even likely to rely on Google for anything this important; every other week there's a thread about Google killing off accounts for no reason. No way would any sane person allow Google access to this with their track record. And this isn't even considering my suspicion that Google only wants to "help…

Exactly. I will never trust Google to control access to my logins knowing that the Sword of Damocles (the Google "AI" deciding I'm a bad person) is hanging over my head.

If Google did an about face and started providing reasonable escalation mechanisms for when they lock you out of your account based on a faulty decision of their algorithm I'd consider it.

Re: Bringing passkeys to Android and Chrome

#53

Post by dane-pgp »

selykg wrote: post #51
stevewatson301 wrote: post #29

Earlier quoted context omitted.

You'll be out of luck when trying to switch from one ecosystem to another (for example, from Apple to Google).

This is really no different between switching hardware devices. Step 1. Sign in using your existing device Step 2. Add your new device Step 3. Remove your old device (or keep it for a backup) And if you feel that's going to be a big issue for you, use a 3rd party software based tool like Bitwarden, 1Password, or other tools that have indicated they'll be supporting this. That info will sync between those software bas…

> Step 1. Sign in using your existing device

That's possible, unless you are switching device because your previous one broke (or was destroyed/stolen/lost).

I imagine that Apple has very precise data about the reasons why (and situations where) people switch from iOS to Android, and making that switch as unthinkable as possible is part of their user-retention efforts.

Re: Bringing passkeys to Android and Chrome

#55

Post by forty »

account-5 wrote: post #36

I don't use my phone to log in to anything. All my stuff is done on a computer with a password manager. At no time am I even likely to rely on Google for anything this important; every other week there's a thread about Google killing off accounts for no reason. No way would any sane person allow Google access to this with their track record. And this isn't even considering my suspicion that Google only wants to "help…

You might be able to do "passkey" with your password manager https://www.theverge.com/2022/8/31/23329373/dashlane-passkey... (I work for this specific one, but I'm sure others have similar things in the work)

Re: Bringing passkeys to Android and Chrome

#56

Post by 988747 »

numbsafari wrote: post #33
toomuchtodo wrote: post #26

Earlier quoted context omitted.

Yes, definitely. USPS + Login.gov could act as trust anchors, with cryptographic keys reprovisioned upon proofing, versus storing them. I am open to whatever is the optimal balance between security and practicality. https://www.uspsoig.gov/document/role-postal-service-identit... > The Postal Service Reform Act of 2022 has recently expanded the Postal Service’s ability to provide identity verification to all levels of…

Except that here in the US a non-trivial number of politicians of a particular persuasion[1] actually believe that government issued ID, of any kind, is the "mark of the beast". There's a reason that Real ID had a lot of push back. Having USPS, already a political bogey-man for that same crowd, become a holder of "identity" is probably going to face a lot of pushback. [1] just one, recent example... https://www.al.co…

I think it's mostly because easily obtainable government ID will make it easy for Black and Latino people to register for vote, which means Republicans will never win any election ever again :)

Re: Bringing passkeys to Android and Chrome

#57

Post by yupper32 »

webmobdev wrote: post #49
wnevets wrote: post #27

Passkeys sound like another way for companies like Google and Apple to lock you into their walled garden. Having each walled garden randomly generating a key for every single domain instead of using the actual domain name as part of the key is a great way to lock regular people into their respective ecosystems.

This is also going to be a body blow for our privacy - if BigTech have access to your keys, so will the government and both can abuse it. The idea is to force you to "save password on device" (whether you want to or not) so that when a government authority gets your device they can also easily access all your internet accounts. US courts have already affirmed that it is legal for the police to force you to unlock you…

Why would this be different than any other password manager in that aspect?

Re: Bringing passkeys to Android and Chrome

#58

Post by selykg »

dane-pgp wrote: post #53
selykg wrote: post #51

Earlier quoted context omitted.

This is really no different between switching hardware devices. Step 1. Sign in using your existing device Step 2. Add your new device Step 3. Remove your old device (or keep it for a backup) And if you feel that's going to be a big issue for you, use a 3rd party software based tool like Bitwarden, 1Password, or other tools that have indicated they'll be supporting this. That info will sync between those software bas…

> Step 1. Sign in using your existing device That's possible, unless you are switching device because your previous one broke (or was destroyed/stolen/lost). I imagine that Apple has very precise data about the reasons why (and situations where) people switch from iOS to Android, and making that switch as unthinkable as possible is part of their user-retention efforts.

Sure, but here's the deal with this. Even with Yubikeys it has always been recommended (as long as I've been involved in these types of discussions anyway) that you should have two of them. If you lose one you have one safely secured that can get you into any service you need to.

This is my general stance on it as well, and one that I think I would still strongly recommend even in this new Passkeys era. That would cover situations where your device is damaged and you can't easily turn the old device on.

Part of this is solved by these keys being synced on each's services, they're synced via iCloud Keychain on Apple's side for instance, so you'd just need to get a new Apple device, sign into your iCloud account and provide the password for iCloud Keychain then you're off to the races. But if in the middle of this you opt to switch from Apple to Android, you're SOL unless you have a backup.

Just my two cents on it, I don't think any of this completely solves the need for backups, but for some portion of people it probably does, and that's those that are unlikely to switch between platforms.

Re: Bringing passkeys to Android and Chrome

#59

Post by goalieca »

webmobdev wrote: post #49
wnevets wrote: post #27

Passkeys sound like another way for companies like Google and Apple to lock you into their walled garden. Having each walled garden randomly generating a key for every single domain instead of using the actual domain name as part of the key is a great way to lock regular people into their respective ecosystems.

This is also going to be a body blow for our privacy - if BigTech have access to your keys, so will the government and both can abuse it. The idea is to force you to "save password on device" (whether you want to or not) so that when a government authority gets your device they can also easily access all your internet accounts. US courts have already affirmed that it is legal for the police to force you to unlock you…

There will be services from 1password, yubikey, etc. This is actually great news!
Post reply on HN