4 ms·

It seems that they are set up to be like this already. At least Chrome+Android treat these passkeys like any password and they can be synced and accessed via AP

It seems that they are set up to be like this already. At least Chrome+Android treat these passkeys like any password and they can be synced and accessed via API. I already see my passkeys in Chrome btw. https://developers.google.com/identity/passkeys/supported-environments#:~:text=Passkeys%20from%20Google%20Password%20Manager%20are%20available%20to%20all%20Android%20apps%2C%20including%20Chrome%20and%20other%20browsers https://developers.google.com/identity/passkeys/supported-en... This sounds pretty good to me, this is therefore like a regular old password except it's a cryptographic key that I don't have to remember and it's secured by whatever device PIN or face unlock that the device has. I think this might have a chance to succeed. Unfortunately the UI popups they implemented are not good, they need to remove the "usb security key" option and hide it under an advanced options tab. Anyone who uses that is an expert, please only prompt for the default device verification, like Windows Hello or face unlock on an iPhone. Also the fact that Chrome by default prompts for a QR code + mobile signin flow is a bit crazy to me, it seems they are very confident that everyone who has a desktop wants to login via phone. Which makes no sense to me, do I really want to use my phone to login to all my desktop applications? I don't think so, maybe younger people who only have laptops + phones do this but still.. why would this be the default, surely Windows Hello or whatever MacOSX uses on desktop is still faster than picking up my phone constantly. I tried it and I was very surprised that it almost worked flawlessly. It asked me to automatically turn on my bluetooth, it connected to my PC's bluetooth within seconds and actually created a working login for my desktop via my mobile phone. It's impressive that this worked... except for the part that the "sign up" popup on desktop never went away automatically!

crote 3y ago
> this is therefore like a regular old password Well that's part of the problem, isn't it? It is being treated as if it is 2FA, but in practice it is barely more secure than a cloud-synced password.
danShumway 3y ago
> It seems that they are set up to be like this already. At least Chrome+Android treat these passkeys like any password and they can be synced and accessed via API. That same link shows that not only is this unsupported on Linux, there are no plans to support it on Chrome Linux. That's a far cry from "like any password". If it's just an API, is the issue that there needs to be a Linux provider that offers that API? Are there plans to work with the community to build one? Is that Linux provider going to run on custom kernels, or will it only run on a signed Ubuntu image? As it stands today, I actually can't use Chrome's WebAuthn implementation on any of computers except through its back-up "use your phone" method, which is a lot more inconvenient. And Google is telling me it has no plans to support my computers. Meanwhile, if someone uses passwords, I can tell them to switch to Linux and I don't need to provide the caveat that they won't be able to log into any of their accounts now without using a phone.
fao_ 3y ago
> This sounds pretty good to me, this is therefore like a regular old password except it's a cryptographic key that I don't have to remember and it's secured by whatever device PIN or face unlock that the device has. So is my password, because I use (password manager).

crote 3y ago

> this is therefore like a regular old password Well that's part of the problem, isn't it? It is being treated as if it is 2FA, but in practice it is barely more secure than a cloud-synced password.

danShumway 3y ago

> It seems that they are set up to be like this already. At least Chrome+Android treat these passkeys like any password and they can be synced and accessed via API. That same link shows that not only is this unsupported on Linux, there are no plans to support it on Chrome Linux. That's a far cry from "like any password". If it's just an API, is the issue that there needs to be a Linux provider that offers that API? Are there plans to work with the community to build one? Is that Linux provider going to run on custom kernels, or will it only run on a signed Ubuntu image? As it stands today, I actually can't use Chrome's WebAuthn implementation on any of computers except through its back-up "use your phone" method, which is a lot more inconvenient. And Google is telling me it has no plans to support my computers. Meanwhile, if someone uses passwords, I can tell them to switch to Linux and I don't need to provide the caveat that they won't be able to log into any of their accounts now without using a phone.

fao_ 3y ago

> This sounds pretty good to me, this is therefore like a regular old password except it's a cryptographic key that I don't have to remember and it's secured by whatever device PIN or face unlock that the device has. So is my password, because I use (password manager).