7 ms·

So it's like a private key but you can't access or manage it, as it's owned by Google/Apple/Microsoft? How convenient!

by mastazi 3y ago

bogwog 3y ago
Not sure if you’re being sarcastic, but that really is convenient.
- ThunderSizzle 3y ago
  Until it's not and they decide you shouldn't exist anymore.
  - avidiax 3y ago
    Precisely this. What happens when Google decides that your account is banned, and no, we don't have to tell you why, and we regret to inform you we have automatically reviewed this decision and it is final?
  - bogwog 3y ago
    Owning the private key for your Google account isn’t going to prevent that in any way.
internetter 3y ago
My reaction as well. From Google's FAQ: > Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager. I don't like this. Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration. I certainly don't like the lack of emphasis on interoperability from the get go. I do not like this future.
- jacooper 3y ago
  AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. Also it seems that Linux is completely out of the picture.
  - dwaite 3y ago
    > AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. The Android implementation allowing for multiple third part passkey providers (typically, existing password manager that want to support passkeys) is in beta. Apple does not pre-announce features, so we are all likely in the dark on their timelines, and whether their timelines extend to infinity. However, I believe a passkey manager can replace the system implementation via the web extension mechanism in mobile Safari today.
  - chlorion 3y ago
    You can use passkeys from a FOSS client on Linux, you can even use your Yubikey if you have one.
    - mastazi 3y ago
      just because there are APIs that a FOSS client can call, that doesn't guarantee interoperabiltiy.
- dwaite 3y ago
  > Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration It is all user terminology for Web Authentication features, so credentials stored on a current Yubikey are also "passkeys". There are multiple open source security key hardware implementations that support the published specs. There are multiple password managers that have started to implement "passkey manager" functionality - 1Password and Dashlane have made announcements here and have published code and Web Extensions for desktop. Android 14 beta has a system API where software providers such as 1Password and Dashlane can work with this system, not just for Chrome but for installed applications. I doubt Google's Password Manager will ever be open sourced, but it doesn't need to be for an interoperable ecosystem.
  - internetter 3y ago
    Thank you didn't know this! I just hope the underdog can stand a chance against the "it just comes with it"
    - dwaite 3y ago
      I do too. The ability for a smaller focused company to innovate and pivot to find unique markets is way different than what the platforms will ever offer. I suspect passkeys provide new ways to innovate beyond what they have been able to do with passwords in the past. Assuming there is an ecosystem where they can play equally, I suspect they will find all sorts of ways to provide unique value. Their goal shouldn't to be the preferred system across all of Android or iOS, but to offer something a lot of people are willing to pay for.
  - mastazi 3y ago
    > but it doesn't need to be for an interoperable ecosystem. what you described above doesn't guarantee that the ecosystem is interoperable. With passwords, there is no way for the service provider to hide the cleartext password from you, this is inherent to the way passwords work. With passkey, a service provider could decide to hide the private keys from you, effectively locking you into their ecosystem, and there is nothing you could do to avoid this.
- cultureswitch 3y ago
  The thing with these authentication services is that if Google doesn't like you and blocks your account, you're fucked. This is not a remote possibility. It happens to thousands of people every day, for entirely frivolous reasons. Until there is some authentication system that is genuinely robust to corporate control attacks, I'll keep using the imperfect password manager model.
chlorion 3y ago
Passkey is an open standard, clients are not limited to Android or IOS devices. You can for example use a Yubikey, on a Linux desktop system, to authenticate to services implementing the "passkey" standard. Does Google own my Yubikey in some way that I'm unaware of? Nothing is owned by Google or Apple or Microsoft, there is no grand conspiracy trying to lock you into a platform. Try educating yourself before spreading misinformation, and before assuming that everything is an Evil Conspiracy by Big Tech.
- deleted 3y ago
  [deleted]
- bscphil 3y ago
  Possibly a dumb question... the Yubikeys a bunch of us own were originally sold as U2F / FIDO keys. My understanding of this system was that it was, as labeled, a "universal second factor" standard. But passkey is supposed (?) to be a single-factor (something you have, not something you know). Is it doing this just by (ab)using the "second factor" approach for single factor auth? Or is there something a little more sophisticated, and hopefully more secure, happening here? I tried to do some research myself, but there's no Wikipedia page for "passkeys" and they aren't mentioned on the Yubikey article. Edit: this user has a helpful comment: https://news.ycombinator.com/item?id=35810144 https://news.ycombinator.com/item?id=35810144 > Passkeys add in user verification as a capability so that you can use them for the entire authentication process rather than as just one of the factors. This typically means a biometric challenge or knowledge based challenge, such as PIN/passcode entry. I'd love to know more about how / whether these challenges are enforced as part of an open standard, or whether it's up to individual implementers of passkeys to roll their own.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- deleted 3y ago
mk89 3y ago
No, hold on. That's not what I implied. My understanding is that the private key is stored on your own device, unless you decide to use something like iCloud Keychain (which should be encrypted). The public key, on the other hand, is stored on the service providers' servers. That is used to create a "challenge", which I guess on your phone you will need to "decrypt/sign" with the private key to prove that "it's really you". That's how I understand it.
- mastazi 3y ago
  Some devices e.g. Apple have a Secure Enclave that is not user accessible, that's what I'm referring to, I'm not suggesting that they are stored on a server.

So it's like a private key but you can't access or manage it, as it's owned by Google/Apple/Microsoft? How convenient!

bogwog 3y ago

Not sure if you’re being sarcastic, but that really is convenient.

ThunderSizzle 3y ago
Until it's not and they decide you shouldn't exist anymore.
- avidiax 3y ago
  Precisely this. What happens when Google decides that your account is banned, and no, we don't have to tell you why, and we regret to inform you we have automatically reviewed this decision and it is final?
- bogwog 3y ago
  Owning the private key for your Google account isn’t going to prevent that in any way.

internetter 3y ago

My reaction as well. From Google's FAQ: > Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager. I don't like this. Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration. I certainly don't like the lack of emphasis on interoperability from the get go. I do not like this future.

jacooper 3y ago
AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. Also it seems that Linux is completely out of the picture.
- dwaite 3y ago
  > AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. The Android implementation allowing for multiple third part passkey providers (typically, existing password manager that want to support passkeys) is in beta. Apple does not pre-announce features, so we are all likely in the dark on their timelines, and whether their timelines extend to infinity. However, I believe a passkey manager can replace the system implementation via the web extension mechanism in mobile Safari today.
- chlorion 3y ago
  You can use passkeys from a FOSS client on Linux, you can even use your Yubikey if you have one.
  - mastazi 3y ago
    just because there are APIs that a FOSS client can call, that doesn't guarantee interoperabiltiy.
dwaite 3y ago
> Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration It is all user terminology for Web Authentication features, so credentials stored on a current Yubikey are also "passkeys". There are multiple open source security key hardware implementations that support the published specs. There are multiple password managers that have started to implement "passkey manager" functionality - 1Password and Dashlane have made announcements here and have published code and Web Extensions for desktop. Android 14 beta has a system API where software providers such as 1Password and Dashlane can work with this system, not just for Chrome but for installed applications. I doubt Google's Password Manager will ever be open sourced, but it doesn't need to be for an interoperable ecosystem.
- internetter 3y ago
  Thank you didn't know this! I just hope the underdog can stand a chance against the "it just comes with it"
  - dwaite 3y ago
    I do too. The ability for a smaller focused company to innovate and pivot to find unique markets is way different than what the platforms will ever offer. I suspect passkeys provide new ways to innovate beyond what they have been able to do with passwords in the past. Assuming there is an ecosystem where they can play equally, I suspect they will find all sorts of ways to provide unique value. Their goal shouldn't to be the preferred system across all of Android or iOS, but to offer something a lot of people are willing to pay for.
- mastazi 3y ago
  > but it doesn't need to be for an interoperable ecosystem. what you described above doesn't guarantee that the ecosystem is interoperable. With passwords, there is no way for the service provider to hide the cleartext password from you, this is inherent to the way passwords work. With passkey, a service provider could decide to hide the private keys from you, effectively locking you into their ecosystem, and there is nothing you could do to avoid this.
cultureswitch 3y ago
The thing with these authentication services is that if Google doesn't like you and blocks your account, you're fucked. This is not a remote possibility. It happens to thousands of people every day, for entirely frivolous reasons. Until there is some authentication system that is genuinely robust to corporate control attacks, I'll keep using the imperfect password manager model.

chlorion 3y ago

Passkey is an open standard, clients are not limited to Android or IOS devices. You can for example use a Yubikey, on a Linux desktop system, to authenticate to services implementing the "passkey" standard. Does Google own my Yubikey in some way that I'm unaware of? Nothing is owned by Google or Apple or Microsoft, there is no grand conspiracy trying to lock you into a platform. Try educating yourself before spreading misinformation, and before assuming that everything is an Evil Conspiracy by Big Tech.

deleted 3y ago
[deleted]
bscphil 3y ago
Possibly a dumb question... the Yubikeys a bunch of us own were originally sold as U2F / FIDO keys. My understanding of this system was that it was, as labeled, a "universal second factor" standard. But passkey is supposed (?) to be a single-factor (something you have, not something you know). Is it doing this just by (ab)using the "second factor" approach for single factor auth? Or is there something a little more sophisticated, and hopefully more secure, happening here? I tried to do some research myself, but there's no Wikipedia page for "passkeys" and they aren't mentioned on the Yubikey article. Edit: this user has a helpful comment: https://news.ycombinator.com/item?id=35810144 https://news.ycombinator.com/item?id=35810144 > Passkeys add in user verification as a capability so that you can use them for the entire authentication process rather than as just one of the factors. This typically means a biometric challenge or knowledge based challenge, such as PIN/passcode entry. I'd love to know more about how / whether these challenges are enforced as part of an open standard, or whether it's up to individual implementers of passkeys to roll their own.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
deleted 3y ago

mk89 3y ago

No, hold on. That's not what I implied. My understanding is that the private key is stored on your own device, unless you decide to use something like iCloud Keychain (which should be encrypted). The public key, on the other hand, is stored on the service providers' servers. That is used to create a "challenge", which I guess on your phone you will need to "decrypt/sign" with the private key to prove that "it's really you". That's how I understand it.

mastazi 3y ago
Some devices e.g. Apple have a Secure Enclave that is not user accessible, that's what I'm referring to, I'm not suggesting that they are stored on a server.