3 ms·

You still have 2 factors: - Something you own, your device with a passkey on it AND - Something you are, your biometrics OR - Something you know, your PIN

You still have 2 factors: - Something you own, your device with a passkey on it AND - Something you are, your biometrics OR - Something you know, your PIN Either of which you need, at least in every single implementation of passkeys I've used.

greatgib 4y ago
The pin or biometrics is just in the client side, let's say to decipher the private key before usage. No? Probably even not an encrypted key but just to protect your local passkey holder. I don't think that any of this is sent to the website.
- mynameisvlad 4y ago
  It’s still required to complete authentication. If you don’t present one of them, your authenticator will not function. It’s used to unlock the private key. It’s not the website confirming your second factor, but the Authenticator. And that’s on purpose; I don’t think I’d want a website being able to store a copy of my biometrics.
  - greatgib 4y ago
    Yes, but so it goes back to my point. If Google cloud is storing your private key, probably not cyphered with your biometric because they would have also to backup your biometric data to backport on the other device. So they have everything they need to use it pretending to be you with your device.
    - mynameisvlad 4y ago
      What? No. It stores your private key, which is per site. You use your biometrics to unlock it and sign in. If you upload your password protected SSH private key to Dropbox for safe keeping, a person will still need your password to use it even if they gain access to it. How is this any different?
      - greatgib 4y ago
        Let's be clear, I think that you are mixing up what I mean by Google. There is the android device on one side (that can have pin and biometric to uncypher the key). And on the other side there is Google the cloud, where device passwords are currently possibly stored if you allowed it (accidentally or not). The goal is to have your passwords and I guess passkey being synchronized between your devices and easily setup with new devices. Very obviously they will not upload your biometric info. So we can assume that on the cloud side they can access your private keys. If either they are still protected with your pin, that would be easily crackable.
        mynameisvlad 4y ago
        Whether it’s easily crackable or not doesn’t take away from the fact that it is 2FA. If someone broke into your computer and found a file called 2fa_setup_codes.txt and uploaded it to the internet, you’re still using 2FA. Just because the setup code is available for yourself or someone else to use doesn’t impact the technology. It’s still 2FA/MFA. This is exactly equivalent. And, sure, Google could do that. They certainly have the computing power to likely do that across their users. But what, exactly, is their incentive to do so? What makes this in any way shape or form realistic as opposed to paranoid delusions? And, I mean, just don’t sync your passkeys if you are concerned about this. It seems like entirely a manufactured problem.
  - codedokode 4y ago
    > It’s still required to complete authentication. As I understand, if an attacker gains root access to your phone (or if an attacker is Google) then they can bypass any biometric locks, export private keys protected with a PIN and bruteforce the PIN. Phones allow exporting keys to sync them between devices via Google cloud. So Google or their friends from government can bruteforce PINs for backups stored in their cloud. Please correct me if I am wrong, but this looks like a single factor.
    - mynameisvlad 4y ago
      So they have something you own, they broke into your phone, and they have something you know, they brute forced your PIN. How is that not still 2FA? If someone breaks into your computer and you happen to have written down all your 2FA setup codes in a text file, you’re still using 2FA even though they now have access to your codes. I don’t fully know the mechanics of the Secure Enclave or Android equivalent but I would be surprised if it allowed exporting private keys without some form of authentication, separate from unlocking your phone. You have to reauthenticate each time you use your passkey, likely on purpose.

greatgib 4y ago

The pin or biometrics is just in the client side, let's say to decipher the private key before usage. No? Probably even not an encrypted key but just to protect your local passkey holder. I don't think that any of this is sent to the website.

mynameisvlad 4y ago
It’s still required to complete authentication. If you don’t present one of them, your authenticator will not function. It’s used to unlock the private key. It’s not the website confirming your second factor, but the Authenticator. And that’s on purpose; I don’t think I’d want a website being able to store a copy of my biometrics.
- greatgib 4y ago
  Yes, but so it goes back to my point. If Google cloud is storing your private key, probably not cyphered with your biometric because they would have also to backup your biometric data to backport on the other device. So they have everything they need to use it pretending to be you with your device.
  - mynameisvlad 4y ago
    What? No. It stores your private key, which is per site. You use your biometrics to unlock it and sign in. If you upload your password protected SSH private key to Dropbox for safe keeping, a person will still need your password to use it even if they gain access to it. How is this any different?
    - greatgib 4y ago
      Let's be clear, I think that you are mixing up what I mean by Google. There is the android device on one side (that can have pin and biometric to uncypher the key). And on the other side there is Google the cloud, where device passwords are currently possibly stored if you allowed it (accidentally or not). The goal is to have your passwords and I guess passkey being synchronized between your devices and easily setup with new devices. Very obviously they will not upload your biometric info. So we can assume that on the cloud side they can access your private keys. If either they are still protected with your pin, that would be easily crackable.
      - mynameisvlad 4y ago
        Whether it’s easily crackable or not doesn’t take away from the fact that it is 2FA. If someone broke into your computer and found a file called 2fa_setup_codes.txt and uploaded it to the internet, you’re still using 2FA. Just because the setup code is available for yourself or someone else to use doesn’t impact the technology. It’s still 2FA/MFA. This is exactly equivalent. And, sure, Google could do that. They certainly have the computing power to likely do that across their users. But what, exactly, is their incentive to do so? What makes this in any way shape or form realistic as opposed to paranoid delusions? And, I mean, just don’t sync your passkeys if you are concerned about this. It seems like entirely a manufactured problem.
- codedokode 4y ago
  > It’s still required to complete authentication. As I understand, if an attacker gains root access to your phone (or if an attacker is Google) then they can bypass any biometric locks, export private keys protected with a PIN and bruteforce the PIN. Phones allow exporting keys to sync them between devices via Google cloud. So Google or their friends from government can bruteforce PINs for backups stored in their cloud. Please correct me if I am wrong, but this looks like a single factor.
  - mynameisvlad 4y ago
    So they have something you own, they broke into your phone, and they have something you know, they brute forced your PIN. How is that not still 2FA? If someone breaks into your computer and you happen to have written down all your 2FA setup codes in a text file, you’re still using 2FA even though they now have access to your codes. I don’t fully know the mechanics of the Secure Enclave or Android equivalent but I would be surprised if it allowed exporting private keys without some form of authentication, separate from unlocking your phone. You have to reauthenticate each time you use your passkey, likely on purpose.