4 ms·

> Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration It is all user terminology for Web

by dwaite 4y ago

> Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration It is all user terminology for Web Authentication features, so credentials stored on a current Yubikey are also "passkeys". There are multiple open source security key hardware implementations that support the published specs. There are multiple password managers that have started to implement "passkey manager" functionality - 1Password and Dashlane have made announcements here and have published code and Web Extensions for desktop. Android 14 beta has a system API where software providers such as 1Password and Dashlane can work with this system, not just for Chrome but for installed applications. I doubt Google's Password Manager will ever be open sourced, but it doesn't need to be for an interoperable ecosystem.

internetter 4y ago
Thank you didn't know this! I just hope the underdog can stand a chance against the "it just comes with it"
- dwaite 4y ago
  I do too. The ability for a smaller focused company to innovate and pivot to find unique markets is way different than what the platforms will ever offer. I suspect passkeys provide new ways to innovate beyond what they have been able to do with passwords in the past. Assuming there is an ecosystem where they can play equally, I suspect they will find all sorts of ways to provide unique value. Their goal shouldn't to be the preferred system across all of Android or iOS, but to offer something a lot of people are willing to pay for.
mastazi 4y ago
> but it doesn't need to be for an interoperable ecosystem. what you described above doesn't guarantee that the ecosystem is interoperable. With passwords, there is no way for the service provider to hide the cleartext password from you, this is inherent to the way passwords work. With passkey, a service provider could decide to hide the private keys from you, effectively locking you into their ecosystem, and there is nothing you could do to avoid this.
- dwaite 4y ago
  I don't know what a service provider is in this case for sure, but I'll assume you mean something like Google Password Manager or iCloud Keychain or 1Password. There's no guarantee that they will act in a user-beneficial manner, except they all already exist and already act in a user beneficial manner, and that there is no strategic benefit of acting in a user-hostile manner. > With passwords, there is no way for the service provider to hide the cleartext password from you Sure there is. They could refuse to do anything but form fill the passwords on registration and authentication pages, where the field in the browser will not allow you to copy the password back out. The force that keeps them from doing such user-hostile behavior for lock-in today is that nobody would want to use that system. They would not use that vendor. It would be product suicide. > effectively locking you into their ecosystem, and there is nothing you could do to avoid this. Unlike passwords, sites are encouraged to allow you to register multiple passkeys. Some sites may push the user to do this for convenience, such as if they see user utilizing a security key or phone to authenticate into their desktop when the desktop is capable of doing passkeys directly. This gives a whole new ability to jump ship if you decide you don't like your software vendor. Now, there is a parallel question of "what if a vendor uses their monopolistic power to prevent an ecosystem from being created, and then acts in a user-malicious manner". I suspect they would quickly get multi-national scrutiny.
- deleted 4y ago
  [deleted]
- lima 4y ago
  WebAuthn is a standard. From what I understood, can use any third-party authenticator like a YubiKey instead of Google's implementation.
  - mastazi 3y ago
    > can use any third-party authenticator You can, but most people won't because they will be locked-in, this is not the case with passwords as it's quite easy to change password manager without having to reset all your passwords.
  - deleted 3y ago

by dwaite 4y ago

internetter 4y ago

Thank you didn't know this! I just hope the underdog can stand a chance against the "it just comes with it"

dwaite 4y ago
I do too. The ability for a smaller focused company to innovate and pivot to find unique markets is way different than what the platforms will ever offer. I suspect passkeys provide new ways to innovate beyond what they have been able to do with passwords in the past. Assuming there is an ecosystem where they can play equally, I suspect they will find all sorts of ways to provide unique value. Their goal shouldn't to be the preferred system across all of Android or iOS, but to offer something a lot of people are willing to pay for.

mastazi 4y ago

> but it doesn't need to be for an interoperable ecosystem. what you described above doesn't guarantee that the ecosystem is interoperable. With passwords, there is no way for the service provider to hide the cleartext password from you, this is inherent to the way passwords work. With passkey, a service provider could decide to hide the private keys from you, effectively locking you into their ecosystem, and there is nothing you could do to avoid this.

dwaite 4y ago
I don't know what a service provider is in this case for sure, but I'll assume you mean something like Google Password Manager or iCloud Keychain or 1Password. There's no guarantee that they will act in a user-beneficial manner, except they all already exist and already act in a user beneficial manner, and that there is no strategic benefit of acting in a user-hostile manner. > With passwords, there is no way for the service provider to hide the cleartext password from you Sure there is. They could refuse to do anything but form fill the passwords on registration and authentication pages, where the field in the browser will not allow you to copy the password back out. The force that keeps them from doing such user-hostile behavior for lock-in today is that nobody would want to use that system. They would not use that vendor. It would be product suicide. > effectively locking you into their ecosystem, and there is nothing you could do to avoid this. Unlike passwords, sites are encouraged to allow you to register multiple passkeys. Some sites may push the user to do this for convenience, such as if they see user utilizing a security key or phone to authenticate into their desktop when the desktop is capable of doing passkeys directly. This gives a whole new ability to jump ship if you decide you don't like your software vendor. Now, there is a parallel question of "what if a vendor uses their monopolistic power to prevent an ecosystem from being created, and then acts in a user-malicious manner". I suspect they would quickly get multi-national scrutiny.
deleted 4y ago
[deleted]
lima 4y ago
WebAuthn is a standard. From what I understood, can use any third-party authenticator like a YubiKey instead of Google's implementation.
- mastazi 3y ago
  > can use any third-party authenticator You can, but most people won't because they will be locked-in, this is not the case with passwords as it's quite easy to change password manager without having to reset all your passwords.
- deleted 3y ago