3 ms·

I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are

by XorNot 4y ago

I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are asleep at the wheel as it's happening. They want to tie you to an external service, so they can tie you to your phone, which they also manage with another external service. All of these schemes are braindead with obtuse, user-unfriendly backup/transfer/restore options. They fail at even making things "simple" for regular users.

bsenftner 4y ago
[flagged]
- deleted 4y ago
  [deleted]
- jmull 4y ago
  To avoid being a propagandized lemming you have to have a basic understanding of what is happening... passkeys aren't tied to Google or to any other specific provider. Note that this announcement is just about Google supporting logging to with passkeys to their platform. But you don't have to have anything to do with Google to use passkeys with other sites/apps that support them.
  - garganzol 4y ago
    Disguising a proprietary development under an industry standard umbrella is a typical move from Corporate Utopia playbook. That's why it is so easy to spot when somebody tries to manipulate public opinion using social media accounts. It would be a totally different situation if customers were actually interested in a particular solution. Otherwise, it's all astroturfing and nothing can really change that. Also it's always a good tone to put a disclaimer, e.g. "Googler".
    - jmull 4y ago
      > Disguising a proprietary development under an industry standard umbrella is a typical move from Corporate Utopia playbook. OK, but is that what's going on here? There's the suggestion in this part of the thread that somehow this all inhibits user freedom. But these objections appear to come out of complete ignorance of what is actually happening. I'm pointing it out because it's the people who are most concerned about corporate manipulation that need to understand what's happening to have any idea on how to guard against it. > Also it's always a good tone to put a disclaimer, e.g. "Googler". I guess you're suggesting I'm a Google shill? Well, (1) you're wrong (in fact, I got rid of all the Google things I used to use personally); (2) did I even say anything helpful to Google? I suggest to take off the tin-foil hat of paranoia. It's not going to protect you from anything and, in fact, will make you more vulnerable if you let it cause you to focus on the wrong things.
    - cromwellian 4y ago
      Ex-Googler, laid off, so no allegiance. It's not a proprietary development. The intention to use private keys for authentication goes all the way back to the KEYGEN tag in HTML. WebAuthn started from FIDO, not Google, and FIDO Alliance was started in 2012 by PayPal, Lenovo, and others, not Google, Apple, etc. Google joined in 2013, and they were mostly interested in 2FA at that point. And prior to that, when I worked at IBM TJ Watson in the 90s on some of the first TPMs, we were developing passkey equivalents using public key crypto for login and digital signatures on ThinkPads and RS/6000 workstations. This work, desire to use public key crypto for authentication, goes back A LONG time practically before the internet was taken over by corporations. This is a good thing for the public. Passwords suck. The number of people who have been pwn3d and phished due to passwords is insane, they're user hostile in so many ways "It would be a totally different situation if customers were actually interested in a particular solution", are customers actually interested in constantly logging in with password and SMS codes -- the default today. Does anyone love using authenticators, or Apple 2FA popups, security keys?
      - garganzol 4y ago
        Thank you for sharing the historical context. So, I have to wear off my tin foil hat, at least for today.
neilalexander 4y ago
Nothing about this is tied to phones or external services. You could just use a hardware authenticator (like a YubiKey) as a device-bound passkey if that is what you prefer.
ajmarsh 4y ago
Nothing prevents anyone from creating an open-source implementation of the FIDO server/services. For example: https://github.com/StrongKey/fido2 https://github.com/StrongKey/fido2
Pxtl 4y ago
Okay, but the alternative is users managing a separate password for every service, which is impossible to do securely without using a password-manager, and the password-manager is basically a weaker version of an external service like Google's.
- recursive 4y ago
  Weaker? The UX for signing in on a new device seems better. Maybe that's the same thing as weaker. I'm not seeing any reason in all of this to switch from a password manager though.
- deleted 4y ago
  [deleted]
ghaff 4y ago
Passwords are terrible for a world where people have hundreds of them and are lazy. And password managers are a bandaid solution. Arguing effectively that passwords were fine for computing in 1970 isn't an answer. So if you don't like passkeys it's reasonable to ask for your alternative.
- garganzol 4y ago
  Whatever an alternative would be, it should be decentralized.
- photochemsyn 4y ago
  The first point seems correct, the second seems incorrect. Remembering a single password for access to a secure well-designed password manager seems a bit more secure than a physical passkey, what am I missing?
  - ghaff 4y ago
    Because password managers that you (and many others) use all the time are probably a more serious attack vector than your bank deposit box.
asimpletune 4y ago
But you still need a password to use a passkey right? So passwords aren’t going away, they’re just being used to a more secure way. My mom can’t tell if a website is fake if it’s made to look exactly like Facebook, for example. So in a sense passwords are actually awful for users because they’re required to remember dozens of passwords and verify that a website is legit. If they just reuse the same password everywhere then they are vulnerable to another kind of attack because some website somewhere will mishandle it, forcing her to change every password on every site afterward. Instead, she can have the best of both worlds by remembering one master password, that basically opens a magic app that will check that the website is legit and create/retrieve a unique passkey for each login.
- eviks 4y ago
  > remember dozens of passwords and verify that a website is legit Or use a password manager to solve both of these issues Except you're not tied to a magic phone

by XorNot 4y ago

bsenftner 4y ago

[flagged]

deleted 4y ago
[deleted]
jmull 4y ago
To avoid being a propagandized lemming you have to have a basic understanding of what is happening... passkeys aren't tied to Google or to any other specific provider. Note that this announcement is just about Google supporting logging to with passkeys to their platform. But you don't have to have anything to do with Google to use passkeys with other sites/apps that support them.
- garganzol 4y ago
  Disguising a proprietary development under an industry standard umbrella is a typical move from Corporate Utopia playbook. That's why it is so easy to spot when somebody tries to manipulate public opinion using social media accounts. It would be a totally different situation if customers were actually interested in a particular solution. Otherwise, it's all astroturfing and nothing can really change that. Also it's always a good tone to put a disclaimer, e.g. "Googler".
  - jmull 4y ago
    > Disguising a proprietary development under an industry standard umbrella is a typical move from Corporate Utopia playbook. OK, but is that what's going on here? There's the suggestion in this part of the thread that somehow this all inhibits user freedom. But these objections appear to come out of complete ignorance of what is actually happening. I'm pointing it out because it's the people who are most concerned about corporate manipulation that need to understand what's happening to have any idea on how to guard against it. > Also it's always a good tone to put a disclaimer, e.g. "Googler". I guess you're suggesting I'm a Google shill? Well, (1) you're wrong (in fact, I got rid of all the Google things I used to use personally); (2) did I even say anything helpful to Google? I suggest to take off the tin-foil hat of paranoia. It's not going to protect you from anything and, in fact, will make you more vulnerable if you let it cause you to focus on the wrong things.
  - cromwellian 4y ago
    Ex-Googler, laid off, so no allegiance. It's not a proprietary development. The intention to use private keys for authentication goes all the way back to the KEYGEN tag in HTML. WebAuthn started from FIDO, not Google, and FIDO Alliance was started in 2012 by PayPal, Lenovo, and others, not Google, Apple, etc. Google joined in 2013, and they were mostly interested in 2FA at that point. And prior to that, when I worked at IBM TJ Watson in the 90s on some of the first TPMs, we were developing passkey equivalents using public key crypto for login and digital signatures on ThinkPads and RS/6000 workstations. This work, desire to use public key crypto for authentication, goes back A LONG time practically before the internet was taken over by corporations. This is a good thing for the public. Passwords suck. The number of people who have been pwn3d and phished due to passwords is insane, they're user hostile in so many ways "It would be a totally different situation if customers were actually interested in a particular solution", are customers actually interested in constantly logging in with password and SMS codes -- the default today. Does anyone love using authenticators, or Apple 2FA popups, security keys?
    - garganzol 4y ago
      Thank you for sharing the historical context. So, I have to wear off my tin foil hat, at least for today.

neilalexander 4y ago

Nothing about this is tied to phones or external services. You could just use a hardware authenticator (like a YubiKey) as a device-bound passkey if that is what you prefer.

ajmarsh 4y ago

Nothing prevents anyone from creating an open-source implementation of the FIDO server/services. For example: https://github.com/StrongKey/fido2 https://github.com/StrongKey/fido2

Pxtl 4y ago

Okay, but the alternative is users managing a separate password for every service, which is impossible to do securely without using a password-manager, and the password-manager is basically a weaker version of an external service like Google's.

recursive 4y ago
Weaker? The UX for signing in on a new device seems better. Maybe that's the same thing as weaker. I'm not seeing any reason in all of this to switch from a password manager though.
deleted 4y ago
[deleted]

ghaff 4y ago

Passwords are terrible for a world where people have hundreds of them and are lazy. And password managers are a bandaid solution. Arguing effectively that passwords were fine for computing in 1970 isn't an answer. So if you don't like passkeys it's reasonable to ask for your alternative.

garganzol 4y ago
Whatever an alternative would be, it should be decentralized.
photochemsyn 4y ago
The first point seems correct, the second seems incorrect. Remembering a single password for access to a secure well-designed password manager seems a bit more secure than a physical passkey, what am I missing?
- ghaff 4y ago
  Because password managers that you (and many others) use all the time are probably a more serious attack vector than your bank deposit box.

asimpletune 4y ago

But you still need a password to use a passkey right? So passwords aren’t going away, they’re just being used to a more secure way. My mom can’t tell if a website is fake if it’s made to look exactly like Facebook, for example. So in a sense passwords are actually awful for users because they’re required to remember dozens of passwords and verify that a website is legit. If they just reuse the same password everywhere then they are vulnerable to another kind of attack because some website somewhere will mishandle it, forcing her to change every password on every site afterward. Instead, she can have the best of both worlds by remembering one master password, that basically opens a magic app that will check that the website is legit and create/retrieve a unique passkey for each login.

eviks 4y ago
> remember dozens of passwords and verify that a website is legit Or use a password manager to solve both of these issues Except you're not tied to a magic phone