Passkeys are now enabled by default for Google users • Hacker News Board

Re: Passkeys are now enabled by default for Google users

#671

Post by rsync » Thu, Oct 12, 2023, 4:51 PM UTC

Whatever13 wrote: post #663

rsync wrote: post #502

Earlier quoted context omitted.

"... This phone NEVER NEVER leaves the house, except ONCE if the bank app requires on location authentication of the phone for the bank app to function ..." Can you elaborate ? What does this "on location" process look like ? What do they ask you to do ?

Pardon for the delay. I'm surprised , i did not know this was not usual in other places. The biggest bank here is Bank of Brazil (state bank), and it has a lot of local physical sites in all over the country, with multiple units in bigger cities. A client ALWAYS has a main physical unit associated with their account, according to the address, and the person is required to physically go there to do many actions. There…

Thanks!

Re: Passkeys are now enabled by default for Google users

#672

Post by trinsic2 » Thu, Oct 12, 2023, 5:23 PM UTC

EGreg wrote: post #533

paiute wrote: post #496

Earlier quoted context omitted.

I think it’s time for a government solution, but nowadays it’d be done to be benefit big tech and the surveillance state.

How about an open source one? https://intercoin.org/overview.pdf

Riiight. Another cryptocurrency solution. crypto falls into the same category of untrustworthiness as the rest of these so called solutions. The only difference is the that crypto has a more murky past.

Re: Passkeys are now enabled by default for Google users

#673

Post by dvngnt_ » Thu, Oct 12, 2023, 6:38 PM UTC

jesseendahl wrote: post #569

dvngnt_ wrote: post #565

Earlier quoted context omitted.

pros and cons to each approach

What are the pros to using phishable passwords and 2FA?

easier to use and harder to be locked out.

years ago i was robbed in dc of my phone at night on the way to a concert. i use google voice and was able to login at cvs to contact a friend to meet me there. in 2023 i would have been locked out by not having a 2fa or phone

Re: Passkeys are now enabled by default for Google users

#674

Post by LegitShady » Thu, Oct 12, 2023, 9:06 PM UTC

qingcharles wrote: post #541

LegitShady wrote: post #219

Earlier quoted context omitted.

Getting locked out of a Google account because I didn't have the number anymore happened to me too. Even though I had everything else even backup email verification, password, etc. Was a massive hassle.

Did you ever get back in?

No

Re: Passkeys are now enabled by default for Google users

#675

Post by tharkun__ » Thu, Oct 12, 2023, 10:15 PM UTC

Nathanba wrote: post #653

tharkun__ wrote: post #649

Earlier quoted context omitted.

From the Last Pass blog about a recent incident: Cloud-based backup storage – contained configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data. All sensitive customer vault data, other than URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses, were encrypted using our Zero knowledge model…

well I really thought that the whole point of passkeys was that they are tied to the device. Syncing a passkey should have only meant that you have a backup, not that you can actually log in from a totally different device with that other device's passkey...

What is the point of a backup if I can't restore the backup to any place my choosing? The point is that if my device get lost, stolen, dies or is damaged irreparably I can always just use another device, restore my backup and done.

So even if there is some sort of hardware tie in that only ever works with real hardware an attacker just needs hardware. Or virtual hardware I guess ;)

Totally out of context parallel: Pokémon Go. A game that gets you out into the world to find and capture Pokémons and talk to other people. Or spoof your GPS coordinates with a simple SDR setup. No anti-cheating software on the phone will ever know.

Re: Passkeys are now enabled by default for Google users

#676

Post by maxwellg » Thu, Oct 12, 2023, 11:43 PM UTC

LeoPanthera wrote: post #415

maxwellg wrote: post #383

Earlier quoted context omitted.

1Password's Passkey support feels very aggressively growth-hacky to me. They intercept calls to `window.credentials` and if you want to use 1Password along side other verifiers like Yubikey, you need to go into your settings and disable their passkeys offering entirely. It's similar to how they also intercept (and globally disable!) Google One Tap prompts in order to show their own OAuth prompt. I only use their Chro…

I'm kind of mad at 1Password - but this isn't correct. When the 1Password prompt some up, you can click the little "USB key" icon which ostensibly is for hardware keys, but all it does is pass control back to the OS, at which point your iCloud prompt, or whatever provider you are using, can be used.

Ah, good to know. I immediately turned off the monkeypatching and didn't spend too much time playing around with it.

Re: Passkeys are now enabled by default for Google users

#677

Post by d-z-m » Fri, Oct 13, 2023, 8:12 AM UTC

two_handfuls wrote: post #668

d-z-m wrote: post #556

Earlier quoted context omitted.

OP specifically mentions "cross-vendor" transferable. Which, to my understanding, is currently true.

You can set up a Yubikey on a mac and use it on a Windows machine. It’s cross-vendor transferrable.

In this case, we're using the term "cross-vendor transferable" to mean that the key material can be exported out of one vendor and imported into another. So if you could export the passkey from Windows Hello and import it into your iCloud Keychain, that would be cross-vendor transferable. Or if you could export the Resident Key out of your Yubikey and import it into Google Password Manager, that would be cross-vendor transferable.

Re: Passkeys are now enabled by default for Google users

#678

Post by two_handfuls » Sat, Oct 14, 2023, 4:15 AM UTC

d-z-m wrote: post #677

two_handfuls wrote: post #668

Earlier quoted context omitted.

You can set up a Yubikey on a mac and use it on a Windows machine. It’s cross-vendor transferrable.

In this case, we're using the term "cross-vendor transferable" to mean that the key material can be exported out of one vendor and imported into another. So if you could export the passkey from Windows Hello and import it into your iCloud Keychain, that would be cross-vendor transferable. Or if you could export the Resident Key out of your Yubikey and import it into Google Password Manager, that would be cross-vendor…

The horror scenario of the parent post was completely avoidable with “not cross-vendor transferrable” keys as I describe.

This “cross-vendor” property is nice but it’s not required to defend against being locked out of one’s stuff.

Re: Passkeys are now enabled by default for Google users

#679

Post by bshacklett » Sun, Oct 15, 2023, 1:17 PM UTC

90-00-09 wrote: post #507

stavros wrote: post #494

Earlier quoted context omitted.

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

How does this address OP's concern? If you have a single device (e.g. an iPhone) and you store all your passkeys on it, then losing it means you lost all passkeys. Your post describes exactly that: - "I can’t recover the keys if I lose the hardware" - "That is a risk you’ll need to take if you’re using hardware authenticators" Fantasizing that with this proposed simplification of the authentication process people wil…

The _full_ quote says:

    “That is a risk you’ll need to take if you’re using hardware authenticators. The fact that the key isn’t copiable means you only have one of it, so you should probably be enrolling multiple hardware authenticators on each account, or just switching to a software authenticator if you don’t care about the decreased security.”
 Software authentication with backup and synchronization is how passkeys are being shown to end users on two of the biggest platforms. For Apple, this is iCloud. For Android, it’s Google Play services. Add to that the fact that 2FA tokens are very often tied to a particular phone, and there’s very little difference between a passkey and the current system of passwords + 2FA, except that passkeys are currently far more resistant to phishing.

Certainly it’s far from perfect, but for the majority of every day users out there, this is a huge potential leap in preventing phishing attacks, which _are_ a real (and growing) threat. Rather than just throwing the technology out, perhaps we, as well informed people, should be looking for solutions to the problem of bootstrapping and recovery, rather than just throwing out the first technology that has a real chance at fixing this problem.

Re: Passkeys are now enabled by default for Google users

#680

Post by bshacklett » Sun, Oct 15, 2023, 1:55 PM UTC

sanitycheck wrote: post #579

jesseendahl wrote: post #567

Earlier quoted context omitted.

Threat #1: Credential theft from server breaches Threat #2: User creates a weak credential Threat #3: User reuses a credential (uses same credential across multiple services) Threat #4: Phishing Attackers use huge password dumps compiled from multiple server breaches, and then try them against other services. Relying on a combination of the fruits of their labor from all four threats, attackers successfully compromis…

You are correct about all of that. But personally, as a technically able user, my risk of randomly losing access to my Google (or MS, Apple, Meta, etc) account is far greater than from all those threats combined. If we had a trustworthy and accountable authority operating this stuff then it would be great. But we don't, we have a bunch of companies who are neither of those things. It's like mandating that everyone mu…

What about the users who _aren’t_ technically able? That’s where this technology is most important at the moment.

That aside, what happens if you lose your current password? Every major platform out there has a method for recovery. Why can’t that be used for passkeys as well? I don’t see how there’s any incentive for companies to lock us out of accounts, when the platform is pointless without people consuming it.

We may have very little power, as users, but if enough people have trouble getting into their own accounts, that’s going to directly impact the bottom line of the company locking them out. From a purely capitalist standpoint, that’s a really good reason to make sure that that doesn’t happen.

Lastly, at least Bitwarden is planning on having passkey support in their password manager very soon, so there’s real competition that will allow users to be in full control of their own passkeys.