2 ms·
I realized I got prompted to start an enroll for this yesterday after reading this webpage. I reacted exactly like this first bullet point: "Some users may be
by knaik94 4y ago
I realized I got prompted to start an enroll for this yesterday after reading this webpage. I reacted exactly like this first bullet point:
"Some users may be surprised if a biometric authentication suddenly appears on a website or an app and think this is sending sensitive information to the server. With passkeys, the user's biometric information is never revealed to the website or the app. Biometric material never leaves the user's personal device."
Having a notification asking me to enable Bluetooth immediately concerned me even though it was clearly the genuine prompt you get get when Google asks you to sign-in by accepting a prompt on a phone.
I don't see myself using this authentication over pass+2factor even though it should be safer because of 2 main reasons. I avoid turning or keeping Bluetooth on and I don't see a clear way to manually control and export the passkey private key. I understand that it's synced via the OS and Google's password manager, but I don't trust it unless I can back it up and restore it to a device myself.
Is there an open, Google independent implementation like Aegis is for 2 factor?
If I can't control and manage my private keys, it's not my private keys. The more I read about this, the less this feels like an improvement to pass+2 factor. Phishing attempts are easier because Banks don't allow non-sms tied 2 factor authentication.
Thinking of this like SSH key based authentication for website made the value of this clear for me. But I don't want my passkey dependent on my Google login.
https://developers.google.com/identity/passkeys https://developers.google.com/identity/passkeys
- stetrain 4y agoNothing about passkeys needs to be tied to Google. You can use other password managers, and it seems like the major players are all supporting the same standard. For example you can use 1Password: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ If they can do it, other password managers both cloud and local should be able to do this as well.
- knaik94 4y agoI look forward to that, but as it stands currently, only Google and Apple's password managers are supported. All of the support documents mention its tied to the OS and linux support isn't planned. The table on this page shows there are no plans of "Local user verification" or "Passkey sync" when using Linux. Additionally it also states that to access the passkey, you need to log in to the given Google account. "Passkeys generated in Chrome on Android are stored in the Google Password Manager. These passkeys are available on all other Android devices as long as Google Password Manager is available and the same user's Google account is signed in." https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....
- stetrain 4y agoSure, if you want to use Chrome + Google password manager. The linked article does say that they will support other password managers on Android at least. And Webauthn/FIDO can be implemented by other browsers and password managers as well. If Google doesn't let third party password manager extensions on Chrome desktop provide passkey support, then that's pretty bad and we'll probably hear from 1Password and LastPass about it since they are also part of the FIDO alliance.
- psanford 4y agoThere are a number of opensource fido key implementations already. There will be opensource passkey implementations.