4 ms·
It’s a password that Google controls so when they incorrectly ban you from their services you lose access to literally everything. Or if you drop your phone in
by berkle4455 3y ago
It’s a password that Google controls so when they incorrectly ban you from their services you lose access to literally everything.
Or if you drop your phone in a lake you’re out of luck too.
- shadowgovt 3y agoIt's the second one, not the first one. The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth. (Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone will still have the private key and can still do the login).
- yeeeloit 3y ago> the phone will still have the private key and can still do the login One of the main gripes people have is about whether or not the user actually has access to the key or not. ie. Can I save my passkey somewhere that I control, can I login on another device, etc. etc. Or do I need google's sync/account to do that for me.
- xdennis 3y ago> Google doesn't have a way to MITM that Google controls the software so it can MITM.
- dahwolf 3y ago"best have another way to auth" right, so passwords it is then.
- Nathanba 3y agowell, the argument is that for strong passwords you will need to use a password manager anyway. Which you will sync somehow, which will sync your passkeys too. So in the end you might as well replace all your passwords with passkeys except for the one password you use to access your passkeys in your password manager / the master access basically. The one way to make sure that you never lose access. I think this makes sense, I'm also very dependent on a password manager now.
- flippinburgers 3y agoUnless there is proof that the hardware on the phone is isolated specifically for this task you cannot make the claim that google is unable to MITM.
- shadowgovt 3y agoYes, the hardware vendor that controls the kernel and chips can do whatever they want. I meant there is no method as per the definition of the protocol to MITM the passkey because the device only ever emits the public key unencrypted.
- grupthink 3y agoBanning has nothing to do with it. You use passkeys as a preferred login method. If you do not have your passkey, you can tap "Try Another Way" and use your password as usual.
- deleted 3y ago[deleted]
- nine_k 3y agoThis means that you still need a password, which you still should store securely. It just becomes much harder to phish out this password.
- reustle 3y agoMaybe "Passkey" + "Magic sign-in link email" will be a good enough combo for most? If you've also lost access to your email, you've got other problems.
- alpos 3y agoThat makes your email box effectively a password vault. Might as well use a service designed for that such as LastPass, or 1Password. Or better still, use a password calculator app such as https://spectre.app/ https://spectre.app/ This kind of approach generates your passwords for different sites based on login information and a single password only you know. No other passwords are stored on any devices or services, not even within the app on the device you are using it on. Which enables you to have different passwords for each service and solves the problem of "too many passwords to remember" without just having to write them all down in a dozen ways that can also be compromised.
- rkarmark 3y agoPasskeys are open, so you can for example store them in a Yubikey if you want. Else many password managers will soon support passkeys, for example 1Password or NordPass. https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://nordpass.com/passwordless/ https://nordpass.com/passwordless/ https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/