4 ms·

there's two things here, passkeys as a mechansim to sign into your google account, and passkeys in general. i'll assume you're asking about passkeys in general

there's two things here, passkeys as a mechansim to sign into your google account, and passkeys in general. i'll assume you're asking about passkeys in general, even though the announcement here is passkeys to sign into your google account - passkeys as a general standard were introduced earlier this year. 1. no, it's a cryptographic key stored on your device. but also yes, because if you're using a passkey on a device you sign into using your google account, google can lock you out of that account and potentially that device. if that device is your only way of logging into a service, you'd be locked out of the service in the same way that losing or destroying the device would lock you out of the service. but authorizing multiple passkeys and adding backup authentication methods is encouraged, so for practical purposes the answer is no. 2. you should understand that passkeys are issued by your device or browser. so if you don't want to trust google, you can use a passkey issued by safari or iPhone instead of Chrome or Android. if you're using an apple-issued passkey to sign into some other service that isn't your google account, google has literally no involvement anywhere in that chain. 3. not according to the spec. the passkey is a certificate that gets stored on your device. your device shares a signature (not the certificate) with the service you're signing into to prove you have access to the certificate. but they're issuing you the cert through their proprietary software. if you don't trust google to not snag a copy of the passkey when they generate it for you, you should use passkeys generated by an issuer that you do trust. (in apple's implementations, passkeys are synced through iCloud, so the answer there is yes - apple does have your passkeys and could sign in to services as you if they wanted. google is not doing that.) 4. you'd have to read the ToS for yourself to figure out what you could sue google for. but the more relevant thing than legal recourse is that this scheme doesn't really give google any power they don't already have, and in many ways distributes power out to third-parties so you have to trust google less. apple's passkey implementation is leading google's. others will follow. this is about allowing you to use an open standard to authenticate with your google account.

devsda 4y ago
On point 1 if google decides to lock you out of its service, it generally doesn't stop at a single device but all other devices you own and associated accounts can also be impacted. So, the solution here seems to be not just creating backup devices (using the same account) but diversify the platforms as well like use a mix of android, yubikey, ios and any other supported platforms. Doubt many people would have the time and resources to do it correctly.
- notatoad 4y ago
  As long as one of the backup methods included in "the time and resources to do it correctly" includes signing in with a password like you always have, I'd guess that most people will have done that.
  - larusso 4y ago
    The fallback to a password in this case feels so wrong. I mean it’s like ssh with password prompt enabled. They let this open for the conversion phase and monitor how often a user with a passkey is still using the password. But the ultimate goal should be to get rid of username/password credentials. I’m still uncertain if this will ever happen though. Given the track record of giant corps to lock out users for various reasons.
- xyzzy123 4y ago
  Also, diversity means you trust all of the providers; from a security perspective it's worse.
  - stouset 4y ago
    No? Your private keys are still on your physical device which you own. The providers do not get your key material. If your threat model includes “the manufacturer of the device I use to authenticate myself is actively working against me”, you are already completely lost.
    - xyzzy123 3y ago
      In order to be usable, many (most?) providers will implement some kind of override to allow recovery workflows. Have a look at https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... and multi-device passkeys. Your keys may never leave secure storage (tho again that is an implementation detail), but how sure are you about the sync implementation or the backend configuration that dictates which keys or methods are acceptable authenticators? As a trivial example, it seems very likely that providers will implement one or more forms of backdoor to ensure that LEOs can access your cloud resources.
handsclean 4y ago
So, if I understand correctly: 1. Google can lock you out, but it’s ok because 1% of users have a workaround, 2. You will lose access, but it’s ok because you won’t if you didn’t use this product, 3. Google can log in as you, but it’s ok because we should trust them not to, and 4. We’ve got no recourse, but it’s ok because we were probably helpless anyway? Companies may get away with this for other products, but the bar is way higher for security products. There are real solutions, or at least ameliorations, and it’d be unsafe to use the product without ensuring they’re there.
- danpalmer 4y ago
  Sorry, but I don't think you do understand correctly, and I mean that in an honest and non-judgemental way, I think you may have misunderstood what Passkeys are, and what this announcement is. With this announcement, you can log into a Google account with a Passkey. That Passkey could be generated by anything implementing the spec – an iPhone, a browser, a home-grown Python script, whatever you want. Google can still lock you out of your Google account whether you use a Passkey or not. If you use your Google account to sign in to other sites, Google can also therefore still prevent you from logging into those other sites, as they have been able to do before (I don't know if they do this as a matter of policy, but they theoretically can). Passkeys do not change this. The only potential place that Passkeys might change things is if you use a Passkey generated by a Google technology, like Android or Chrome. You could use those Passkeys for logging into anything, not just Google accounts. As these are tied to a device, I don't believe the Google account on that device affects them in any way. Google can't lock you out of your Android phone, and can't prevent you using Chrome, so can't prevent you using Passkeys in either of those systems.
  - eduction 4y ago
    [flagged]
    - sowbug 4y ago
      Who are you yelling at? Passkeys are a FIDO thing. Everyone who has implemented them uses the same name. Apple calls them passkeys. Microsoft calls them passkeys. PayPal calls them passkeys. But if you're mad because Google also calls them passkeys, then... OK. (I'm also having trouble squaring "extremely security savvy" with the question whether a security key is a passkey... but OK.)
js2 4y ago
> (in apple's implementations, passkeys are synced through iCloud, so the answer there is yes - apple does have your passkeys and could sign in to services as you if they wanted. google is not doing that.) Passkeys are stored in the iCloud Keychain which is end-to-end encrypted with 256-bit AES. Passkeys cannot be read by Apple anywhere but on your own device.
- 5ersi 4y ago
  So how does a new device join your iCloud and sync Keychain?
  - dan-c-underwood 4y ago
    https://support.apple.com/en-gb/guide/security/sec0a319b35f/web https://support.apple.com/en-gb/guide/security/sec0a319b35f/...
- starfallg 4y ago
  Apple can install any software it wants up to the bootloader (iBoot) level on your iPhone via updates. So technically they can access your keys.
  - j16sdiz 4y ago
    Yes. So do any OS/TPM vendors. Unless you control/audit the whole stack (and forbid updates), you have to trust somebody.
  - judge2020 4y ago
    You can reset your device using an IPSW you got off the internet if you want to make sure Apple isn't shipping targeted firmware to your device specifically.
  - js2 4y ago
    I anticipated this reply which is why I added the qualifier "anywhere but on your own device." Unless you intend to manufacture your own device from scratch, at some point you have to place your trust somewhere. See "reflections on trusting trust": https://web.stanford.edu/class/cs208e/cgi-bin/main.cgi/static/lectures/18-ReflectionsOnTrustingTrust/ReflectionsOnTrustingTrust.pdf https://web.stanford.edu/class/cs208e/cgi-bin/main.cgi/stati...
judge2020 4y ago
> (in apple's implementations, passkeys are synced through iCloud, so the answer there is yes - apple does have your passkeys and could sign in to services as you if they wanted. google is not doing that.) iCloud Keychain is e2ee.

devsda 4y ago

On point 1 if google decides to lock you out of its service, it generally doesn't stop at a single device but all other devices you own and associated accounts can also be impacted. So, the solution here seems to be not just creating backup devices (using the same account) but diversify the platforms as well like use a mix of android, yubikey, ios and any other supported platforms. Doubt many people would have the time and resources to do it correctly.

notatoad 4y ago
As long as one of the backup methods included in "the time and resources to do it correctly" includes signing in with a password like you always have, I'd guess that most people will have done that.
- larusso 4y ago
  The fallback to a password in this case feels so wrong. I mean it’s like ssh with password prompt enabled. They let this open for the conversion phase and monitor how often a user with a passkey is still using the password. But the ultimate goal should be to get rid of username/password credentials. I’m still uncertain if this will ever happen though. Given the track record of giant corps to lock out users for various reasons.
xyzzy123 4y ago
Also, diversity means you trust all of the providers; from a security perspective it's worse.
- stouset 4y ago
  No? Your private keys are still on your physical device which you own. The providers do not get your key material. If your threat model includes “the manufacturer of the device I use to authenticate myself is actively working against me”, you are already completely lost.
  - xyzzy123 3y ago
    In order to be usable, many (most?) providers will implement some kind of override to allow recovery workflows. Have a look at https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... and multi-device passkeys. Your keys may never leave secure storage (tho again that is an implementation detail), but how sure are you about the sync implementation or the backend configuration that dictates which keys or methods are acceptable authenticators? As a trivial example, it seems very likely that providers will implement one or more forms of backdoor to ensure that LEOs can access your cloud resources.

handsclean 4y ago

So, if I understand correctly: 1. Google can lock you out, but it’s ok because 1% of users have a workaround, 2. You will lose access, but it’s ok because you won’t if you didn’t use this product, 3. Google can log in as you, but it’s ok because we should trust them not to, and 4. We’ve got no recourse, but it’s ok because we were probably helpless anyway? Companies may get away with this for other products, but the bar is way higher for security products. There are real solutions, or at least ameliorations, and it’d be unsafe to use the product without ensuring they’re there.

danpalmer 4y ago
Sorry, but I don't think you do understand correctly, and I mean that in an honest and non-judgemental way, I think you may have misunderstood what Passkeys are, and what this announcement is. With this announcement, you can log into a Google account with a Passkey. That Passkey could be generated by anything implementing the spec – an iPhone, a browser, a home-grown Python script, whatever you want. Google can still lock you out of your Google account whether you use a Passkey or not. If you use your Google account to sign in to other sites, Google can also therefore still prevent you from logging into those other sites, as they have been able to do before (I don't know if they do this as a matter of policy, but they theoretically can). Passkeys do not change this. The only potential place that Passkeys might change things is if you use a Passkey generated by a Google technology, like Android or Chrome. You could use those Passkeys for logging into anything, not just Google accounts. As these are tied to a device, I don't believe the Google account on that device affects them in any way. Google can't lock you out of your Android phone, and can't prevent you using Chrome, so can't prevent you using Passkeys in either of those systems.
- eduction 4y ago
  [flagged]
  - sowbug 4y ago
    Who are you yelling at? Passkeys are a FIDO thing. Everyone who has implemented them uses the same name. Apple calls them passkeys. Microsoft calls them passkeys. PayPal calls them passkeys. But if you're mad because Google also calls them passkeys, then... OK. (I'm also having trouble squaring "extremely security savvy" with the question whether a security key is a passkey... but OK.)

js2 4y ago

> (in apple's implementations, passkeys are synced through iCloud, so the answer there is yes - apple does have your passkeys and could sign in to services as you if they wanted. google is not doing that.) Passkeys are stored in the iCloud Keychain which is end-to-end encrypted with 256-bit AES. Passkeys cannot be read by Apple anywhere but on your own device.

5ersi 4y ago
So how does a new device join your iCloud and sync Keychain?
- dan-c-underwood 4y ago
  https://support.apple.com/en-gb/guide/security/sec0a319b35f/web https://support.apple.com/en-gb/guide/security/sec0a319b35f/...
starfallg 4y ago
Apple can install any software it wants up to the bootloader (iBoot) level on your iPhone via updates. So technically they can access your keys.
- j16sdiz 4y ago
  Yes. So do any OS/TPM vendors. Unless you control/audit the whole stack (and forbid updates), you have to trust somebody.
- judge2020 4y ago
  You can reset your device using an IPSW you got off the internet if you want to make sure Apple isn't shipping targeted firmware to your device specifically.
- js2 4y ago
  I anticipated this reply which is why I added the qualifier "anywhere but on your own device." Unless you intend to manufacture your own device from scratch, at some point you have to place your trust somewhere. See "reflections on trusting trust": https://web.stanford.edu/class/cs208e/cgi-bin/main.cgi/static/lectures/18-ReflectionsOnTrustingTrust/ReflectionsOnTrustingTrust.pdf https://web.stanford.edu/class/cs208e/cgi-bin/main.cgi/stati...

judge2020 4y ago