3 ms·
>Creating a passkey on your Google Account makes it an option for sign-in. Existing methods, including your password, will still work in case you need them, for
by hnburnsy 4y ago
>Creating a passkey on your Google Account makes it an option for sign-in. Existing methods, including your password, will still work in case you need them, for example when using devices that don't support passkeys yet. Passkeys are still new and it will take some time before they work everywhere. However, creating a passkey today still comes with security benefits as it allows us to pay closer attention to the sign-ins that fall back to passwords. Over time, we'll increasingly scrutinize these as passkeys gain broader support and familiarity.
So my password that I stupidly shared among my accounts and was then leaked, can still be used to compromise my Google Account.
Wake me when I can create a Google Account without a password, email, or phone number, period.
- Andrex 4y agoProbably not far off. Sounds like with other methods (SMS 2FA, USB hardware key, etc.) you may be able to eventually turn password sign-in off on your Google account and use passkeys exclusively.
- lxgr 4y agoA phone number is both an authentication mode and rudimentary bot/sockpuppet protection. (It’s pretty bad at both, but that’s a different story.) Passkeys can substitute the former, but (by design) not the latter.
- elwebmaster 3y agoThat's it! When I can use solely my hardware security key to signup/login then we are talking. The rest is just marketing.
- drivebycomment 3y agoNothing stops you from registering multiple passkeys, change the password to a long random string and forget about it - then you effectively have passkey only account.
- hnburnsy 3y agoExcellent point, just tried to create a new Google Account and it requires a phone number that can receive a text message so account is still open to SIM swap.