3 ms·

Yes, but so it goes back to my point. If Google cloud is storing your private key, probably not cyphered with your biometric because they would have also to bac

Yes, but so it goes back to my point. If Google cloud is storing your private key, probably not cyphered with your biometric because they would have also to backup your biometric data to backport on the other device. So they have everything they need to use it pretending to be you with your device.

mynameisvlad 4y ago
What? No. It stores your private key, which is per site. You use your biometrics to unlock it and sign in. If you upload your password protected SSH private key to Dropbox for safe keeping, a person will still need your password to use it even if they gain access to it. How is this any different?
- greatgib 4y ago
  Let's be clear, I think that you are mixing up what I mean by Google. There is the android device on one side (that can have pin and biometric to uncypher the key). And on the other side there is Google the cloud, where device passwords are currently possibly stored if you allowed it (accidentally or not). The goal is to have your passwords and I guess passkey being synchronized between your devices and easily setup with new devices. Very obviously they will not upload your biometric info. So we can assume that on the cloud side they can access your private keys. If either they are still protected with your pin, that would be easily crackable.
  - mynameisvlad 4y ago
    Whether it’s easily crackable or not doesn’t take away from the fact that it is 2FA. If someone broke into your computer and found a file called 2fa_setup_codes.txt and uploaded it to the internet, you’re still using 2FA. Just because the setup code is available for yourself or someone else to use doesn’t impact the technology. It’s still 2FA/MFA. This is exactly equivalent. And, sure, Google could do that. They certainly have the computing power to likely do that across their users. But what, exactly, is their incentive to do so? What makes this in any way shape or form realistic as opposed to paranoid delusions? And, I mean, just don’t sync your passkeys if you are concerned about this. It seems like entirely a manufactured problem.

mynameisvlad 4y ago

What? No. It stores your private key, which is per site. You use your biometrics to unlock it and sign in. If you upload your password protected SSH private key to Dropbox for safe keeping, a person will still need your password to use it even if they gain access to it. How is this any different?

greatgib 4y ago
Let's be clear, I think that you are mixing up what I mean by Google. There is the android device on one side (that can have pin and biometric to uncypher the key). And on the other side there is Google the cloud, where device passwords are currently possibly stored if you allowed it (accidentally or not). The goal is to have your passwords and I guess passkey being synchronized between your devices and easily setup with new devices. Very obviously they will not upload your biometric info. So we can assume that on the cloud side they can access your private keys. If either they are still protected with your pin, that would be easily crackable.
- mynameisvlad 4y ago
  Whether it’s easily crackable or not doesn’t take away from the fact that it is 2FA. If someone broke into your computer and found a file called 2fa_setup_codes.txt and uploaded it to the internet, you’re still using 2FA. Just because the setup code is available for yourself or someone else to use doesn’t impact the technology. It’s still 2FA/MFA. This is exactly equivalent. And, sure, Google could do that. They certainly have the computing power to likely do that across their users. But what, exactly, is their incentive to do so? What makes this in any way shape or form realistic as opposed to paranoid delusions? And, I mean, just don’t sync your passkeys if you are concerned about this. It seems like entirely a manufactured problem.