3 ms·

So, if I understand correctly: 1. Google can lock you out, but it’s ok because 1% of users have a workaround, 2. You will lose access, but it’s ok because you

So, if I understand correctly: 1. Google can lock you out, but it’s ok because 1% of users have a workaround, 2. You will lose access, but it’s ok because you won’t if you didn’t use this product, 3. Google can log in as you, but it’s ok because we should trust them not to, and 4. We’ve got no recourse, but it’s ok because we were probably helpless anyway? Companies may get away with this for other products, but the bar is way higher for security products. There are real solutions, or at least ameliorations, and it’d be unsafe to use the product without ensuring they’re there.

danpalmer 3y ago
Sorry, but I don't think you do understand correctly, and I mean that in an honest and non-judgemental way, I think you may have misunderstood what Passkeys are, and what this announcement is. With this announcement, you can log into a Google account with a Passkey. That Passkey could be generated by anything implementing the spec – an iPhone, a browser, a home-grown Python script, whatever you want. Google can still lock you out of your Google account whether you use a Passkey or not. If you use your Google account to sign in to other sites, Google can also therefore still prevent you from logging into those other sites, as they have been able to do before (I don't know if they do this as a matter of policy, but they theoretically can). Passkeys do not change this. The only potential place that Passkeys might change things is if you use a Passkey generated by a Google technology, like Android or Chrome. You could use those Passkeys for logging into anything, not just Google accounts. As these are tied to a device, I don't believe the Google account on that device affects them in any way. Google can't lock you out of your Android phone, and can't prevent you using Chrome, so can't prevent you using Passkeys in either of those systems.
- eduction 3y ago
  [flagged]
  - sowbug 3y ago
    Who are you yelling at? Passkeys are a FIDO thing. Everyone who has implemented them uses the same name. Apple calls them passkeys. Microsoft calls them passkeys. PayPal calls them passkeys. But if you're mad because Google also calls them passkeys, then... OK. (I'm also having trouble squaring "extremely security savvy" with the question whether a security key is a passkey... but OK.)
  - deleted 3y ago
    [deleted]
  - danpalmer 3y ago
    I'm sorry you don't appear to be interested in engaging with the topic. Even a cursory look would reveal that this is a new open standard spearheaded by a cross-industry group. I'm hoping Passkeys do indeed take off as they provide better security for pretty much everyone, and if they do your service providers will most likely adopt them.
seanhunter 3y ago
I am no fan of google, but this is such a grotesque distortion that it feels like you are just pushing an agenda here. 1. They can lock you out of your google account and services you authenticate using login with google, but no more or less than they can lock you out without passkey authentication. 2. You may lose access as per #1, but no differently than if you lost access to your google account having used MFA or whatever other method to log in. It's completely orthogonal. 3. This is just wrong. The passkey is a cert which is used to sign something and send them the signature they can verify with the public part of the cert. They can't login as you. If you don't trust them not to backdoor the passkey itself during generation you can use a passkey generated by someone else. 4. You never had any recourse. This doesn't change that at all either way. It's a login methodology.

danpalmer 3y ago

Sorry, but I don't think you do understand correctly, and I mean that in an honest and non-judgemental way, I think you may have misunderstood what Passkeys are, and what this announcement is. With this announcement, you can log into a Google account with a Passkey. That Passkey could be generated by anything implementing the spec – an iPhone, a browser, a home-grown Python script, whatever you want. Google can still lock you out of your Google account whether you use a Passkey or not. If you use your Google account to sign in to other sites, Google can also therefore still prevent you from logging into those other sites, as they have been able to do before (I don't know if they do this as a matter of policy, but they theoretically can). Passkeys do not change this. The only potential place that Passkeys might change things is if you use a Passkey generated by a Google technology, like Android or Chrome. You could use those Passkeys for logging into anything, not just Google accounts. As these are tied to a device, I don't believe the Google account on that device affects them in any way. Google can't lock you out of your Android phone, and can't prevent you using Chrome, so can't prevent you using Passkeys in either of those systems.

eduction 3y ago
[flagged]
- sowbug 3y ago
  Who are you yelling at? Passkeys are a FIDO thing. Everyone who has implemented them uses the same name. Apple calls them passkeys. Microsoft calls them passkeys. PayPal calls them passkeys. But if you're mad because Google also calls them passkeys, then... OK. (I'm also having trouble squaring "extremely security savvy" with the question whether a security key is a passkey... but OK.)
- deleted 3y ago
  [deleted]
- danpalmer 3y ago
  I'm sorry you don't appear to be interested in engaging with the topic. Even a cursory look would reveal that this is a new open standard spearheaded by a cross-industry group. I'm hoping Passkeys do indeed take off as they provide better security for pretty much everyone, and if they do your service providers will most likely adopt them.

seanhunter 3y ago

I am no fan of google, but this is such a grotesque distortion that it feels like you are just pushing an agenda here. 1. They can lock you out of your google account and services you authenticate using login with google, but no more or less than they can lock you out without passkey authentication. 2. You may lose access as per #1, but no differently than if you lost access to your google account having used MFA or whatever other method to log in. It's completely orthogonal. 3. This is just wrong. The passkey is a cert which is used to sign something and send them the signature they can verify with the public part of the cert. They can't login as you. If you don't trust them not to backdoor the passkey itself during generation you can use a passkey generated by someone else. 4. You never had any recourse. This doesn't change that at all either way. It's a login methodology.