12 ms·

Its also worth pointing out that google, the company making the big passkey push, has a track record of just disabling accounts they don't like for any arbitrar

Its also worth pointing out that google, the company making the big passkey push, has a track record of just disabling accounts they don't like for any arbitrary algorithmic reason. Lose your (google) passkeys account for whatever reason (ai says no, wrongthink, itar ban), and you risk losing your digital life. Edit: If you need MFA please do check out solokey, an open source Fido project. https://solokeys.com/ https://solokeys.com/

josteink 3y ago
That just means avoid making passkeys and/or Google passkeys your only login option. There are other options out there.
- XorNot 3y ago
  Google's stated goal of killing the password though gives the game away. They want to give you no other option.
  - acdha 3y ago
    You really want to learn how this technology works before spreading FUD which will cause people to pick less secure options. Passkeys are a W3C standard and they’re not an SSO system which requires a third-party server to function. If Google closed operations tomorrow, it wouldn’t affect anyone using a passkey to login to any service other than Google’s own.
    - deleted 3y ago
      [deleted]
    - Aeolun 3y ago
      Unless you are storing all your passkeys on a Google server, as Apple seems to require ATM (see article).
    - jasonjayr 3y ago
      If I use passkeys right now, with Google or Apple, and they close up shop tomorrow, I'm screwed. They need to prove that this isn't going to be a bait and switch. Give users 100% control over their pass keys NOW before we consider using the service. Otherwise, they're gonna play the "Oh, but most non-tech users will benifit from this" and then we get critical mass becuse a majority of users are non-tech users, and then the import/export function ends up being like the Official Linux Google Drive Client.
      - acdha 3y ago
        > If I use passkeys right now, with Google or Apple, and they close up shop tomorrow, I'm screwed. No. You’d be screwed when all of your devices stopped working before you enrolled another passkey with the services you use, or setting up a password login if you’d never done that before. That wouldn’t be great but you’d be far more exposed earlier to the fact that you were using devices which no longer receive updates. The important thing to keep in mind here is context: people are getting compromised daily due to password weaknesses. People are going through account recovery processes for similar reasons, too, so a key question isn’t whether there’s a perfect option but rather how it’ll change those numbers.
        XorNot 3y ago
        This is pretending that, as others have noted, Google haven't made a habit of locking out accounts for no reason and providing no path to recovery. That's the point: Google wants to collect your digital life and control it. But they also don't want to deal with any requirements to ensure you can actually use or recover it expediently. So it's not "if Google close up shop" it's "due to reasons we've (our AI decided too) ban your account. Don't bother contacting us, as there is no customer service".
        acdha 3y ago
        > This is pretending that, as others have noted, Google haven't made a habit of locking out accounts for no reason and providing no path to recovery No. Other people have posted incorrect claims but repetition doesn’t make them less wrong. If Google locks your account, you lose the ability to add new devices to that account but all of your current devices will still have their synced keys stored on their devices as well as the ability to use other passkeys, recovery codes, etc. If Google locks your account, this is nowhere near the biggest problem you’ll have.
themagician 3y ago
And when it happens to you, Google will let you know that they reserve the terminate your account for any reason or no reason at all. You will get the same email response over and over again: “We have concluded the review of the information you’ve submitted. To prevent possible fraud and abuse, your Google products and services will remain suspended. It is our policy to not discuss the specific reasons for these suspensions. Note that in the Google <PRODUCT> Terms of Service, we reserve the right to change, suspend, or discontinue any aspect of our services at any time, including availability of a service or any feature, without notice and without liability. We also reserve the right to impose limits on certain Service features or restrict access to some or all of the Services without notice and without liability.” It can wreck your life. Getting a suspension lifted can take a truly stupid amount of effort depending on the reason (if you even know it). For me it involved basically stalking employees until I was able to find someone who could actually review my account. Literally looking up employees by department and name on LinkedIn and Twitter, then trying to find their phone number and texting them. I must have sounded crazy. But I was able to find someone to help. Then it took like 5 minutes to fix. It was clear it was just a mistake on their end—an, “overzealous anti-fraud algorithm.” I probably spent around 60 hours in totally trying to get my account restored. After getting access back I stopped using that account and made sure to distribute access to different accounts and emails. Using a single Google account is just way too risky. The more services you use the more likely you are to encounter an account suspending issue. I’ve heard of many cases where people get hacked and Google’s response is to ban the victim permanently. Facebook has similarly atrocious policies.
- deleted 3y ago
  [deleted]
- psychphysic 3y ago
  Biggest reason I pay for my own domain and low-cost email (tutanota it's offers custom domains for €12pa).
  - themagician 3y ago
    It’s very easy to become complacent. I knew forever that using Google was a risk. I keep email mostly on owned domains… but I also use all sorts of Google services. The thing is, for every Google service you really should have a separate account. One for dev, one for YouTube, one for Gmail, one for Wallet. Maybe one for Chrome if you use it as a password manager. One for AdWords. One for payments if you use any merchant services. Every service you add to an account increases your odds of suspension. Oddly, I’ve also heard that one of the reasons guy can get banned is for having multiple accounts. So I’m not sure if my new policy is any better than my old one.
latexr 3y ago
> google, the company making the big passkey push Google had a recent blog post about it, but the push started with Apple at WWDC22 (and one session at WWDC21), to the point some assumed it was an Apple-only feature. An effort like this requires coordination from major players to take off with the impact they want (replacing passwords). https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fi... 1Password has been tracking services which support passkeys, and so far adoption seems slow. I’ve been checking their website on and off for months and it has hovered at about the same number of websites, occasionally going down. https://passkeys.directory/ https://passkeys.directory/
- progbits 3y ago
  We had apple passkey posts over the last few months with people salivating over it but suddenly they hear google and suddenly the feature is evil from the start. I'm not defending passkeys but you people need to pick a side to shill for.
  - georgyo 3y ago
    Indeed, Apple's passkeys are the in the field of heroic security while Google's is an evil play to take away users power. The flip side here is that Apple gives a user near zero power in their walled garden, and is hostile towards anyone outside of it. So Apple passkeys can't take away user control because they never had any.
    - latexr 3y ago
      You may not believe a statement from Apple, but: https://news.ycombinator.com/item?id=35855113 https://news.ycombinator.com/item?id=35855113
      - admax88qqq 3y ago
        That's not a statement from Apple. That's a statement from an Apple developer. And I have no doubt that he believes it and intends to implement it. But that's not a guarantee that the corporation around him won't decide tomorrow that they don't want to implement it.
gruez 3y ago
>Lose your (google) passkeys account for whatever reason (ai says no, wrongthink, itar ban), and you risk losing your digital life. Isn't this entirely orthogonal to the usage of passkeys? You could "lose your digital life" if you forgot your password, or remembered your password but tripped their risk scoring system (eg. fresh login from an unusual location).
- dv_dt 3y ago
  You could consider it orthogonal before, but would a passkey store accumulate of many more critical accounts could be attached to that google/apple account. So a mistriggered security or regulatory function could cut off access to the account, followed by being cut off from your bank or other accounts wrapped up on that same passkey store?
  - lazide 3y ago
    And DMV and USPS and US State Dept, and a bunch of other places too.
  - m-p-3 3y ago
    > So a mistriggered security or regulatory function could cut off access to the account, followed by being cut off from your bank or other accounts wrapped up on that same passkey store? In terms of key, it's either stored at the OS/browser level (Windows Hello), or at the hardware level (Yubikey). Imagine them as if there were SSH key files; You hold the private key(s), protected by a PIN/password and Google simply has the public key(s) to authenticate you. Even if Google disabled the account, it still doesn't block you from using other stored Passkeys that are tied to other providers. The only place where you'd get in trouble is if these third-parties like the DMV used Google as their SSO.
  - anonymouskimmer 3y ago
    Just a pet peeve of mine directed at you and the GP. "Orthogonal" - the better word for most circumstances unrelated to math is "unrelated". Depending on the situation, "has nothing to do with" works pretty well too. And to the GP: Since passkeys (and passwords, and etcetera) are related to some extent to one's "digital life", then they cannot be "entirely orthogonal". To really, really nitpick, even in math, orthogonality does not imply unrelatedness. Two objects being orthogonal to each other means that they both are related to the extent they belong to the same coordinate system. I guess, by my standards then, using the phrasing "entirely orthogonal" indicates that you believe that the two things are related to the extent they belong to the same coordinate system, but never meet. I don't like this usage because it seems that "digital life" embodies the entire coordinate system in which "passkeys" exist. Nothing is "orthogonal" to its coordinate system, at most it's orthogonal to an axis in that coordinate system. I'm kind of tired of this nitpicking myself, though. Please don't borrow nomenclature from other fields when already existing nomenclature (or better yet, colloquial terms) work just fine. Thanks.
waboremo 3y ago
Passkeys don't rely on Google though, and your linked project can be used as a roaming authenticator for passkeys.
joecool1029 3y ago
> Edit: If you need MFA please do check out solokey, an open source Fido project. I did, but are they vaporware? Website has not been updated with Solo 2 information, but there's a Kickstarter that claims I can still buy early bird keys that will ship almost 2 years ago? Their github repos haven't had meaningful activity in well over a year: https://github.com/solokeys/ https://github.com/solokeys/
- FullyFunctional 3y ago
  Hmm, I don’t know the current status but I did receive and use my keys I got from backing. I have also gotten mails about firmware updates, but nothing recently.
chlorion 3y ago
Ah yes, Google can disable my Linux desktop passkey client when they terminate my Google account. I forgot that they had the ability to do this. If only this passkey thing was a Fido standard that could be used with the product you linked us!
crossroadsguy 3y ago
I had to put a huge amount of effort to move away from Google - actually Google nuked the amount and I never knew why (I had no connections at Google, so that didn't work out). So I anyway do not use Google at all. Now I carefully ensure that I am not depending on Apple/iCloud for anything either, because honestly that is just like Google and even though you can reach a human being at Apple, their support (at least in India) seems to be trained to perfection in stone-walling you and denying you even an escalation. So no, I hope this passkey thing is optional or there are third party players (Mozilla?, BitWarden? etc) in this play. And I hope there will always be a recovery option that will be just user's and not with with the passkey provider "by design". But knowing Apple and Google I think they will make it infinitely harder for any third party to become an option on their devices or platform that there won't really be a competition. It would be worse than the case where "iOS has alternative browsers, but not really". I somehow have a bad feeling about this passkey thing unless third party providers get to become, by explicit user permission and setup, A first class citizen of passkey on. a device.
- denton-scratch 3y ago
  > unless third party providers get to become, by explicit user permission and setup, A first class citizen I'm not keen on handing my identity over to a third-party to manage. And I share the concerns of the commenter up-thread that TLA agencies have fingers in this pie; if they don't, then they're not doing their jobs. I had a go at implementing oAuth and self-hosting it; but part of the problem with (some of) these open protocols is that people with much more time on their hands than you, and with membership on the specification committees, start messing with the protocols and making them much more complicated. That happened to CalDAV - I wrote a CalDAV server, but it was obsolete as soon as it was finished, because the specs had already moved on.
SEJeff 3y ago
I work with several of the original authors of solokeys and can confirm they’re legit and gifted engineers. I own several myself.

josteink 3y ago

That just means avoid making passkeys and/or Google passkeys your only login option. There are other options out there.

XorNot 3y ago
Google's stated goal of killing the password though gives the game away. They want to give you no other option.
- acdha 3y ago
  You really want to learn how this technology works before spreading FUD which will cause people to pick less secure options. Passkeys are a W3C standard and they’re not an SSO system which requires a third-party server to function. If Google closed operations tomorrow, it wouldn’t affect anyone using a passkey to login to any service other than Google’s own.
  - deleted 3y ago
    [deleted]
  - Aeolun 3y ago
    Unless you are storing all your passkeys on a Google server, as Apple seems to require ATM (see article).
  - jasonjayr 3y ago
    If I use passkeys right now, with Google or Apple, and they close up shop tomorrow, I'm screwed. They need to prove that this isn't going to be a bait and switch. Give users 100% control over their pass keys NOW before we consider using the service. Otherwise, they're gonna play the "Oh, but most non-tech users will benifit from this" and then we get critical mass becuse a majority of users are non-tech users, and then the import/export function ends up being like the Official Linux Google Drive Client.
    - acdha 3y ago
      > If I use passkeys right now, with Google or Apple, and they close up shop tomorrow, I'm screwed. No. You’d be screwed when all of your devices stopped working before you enrolled another passkey with the services you use, or setting up a password login if you’d never done that before. That wouldn’t be great but you’d be far more exposed earlier to the fact that you were using devices which no longer receive updates. The important thing to keep in mind here is context: people are getting compromised daily due to password weaknesses. People are going through account recovery processes for similar reasons, too, so a key question isn’t whether there’s a perfect option but rather how it’ll change those numbers.
      - XorNot 3y ago
        This is pretending that, as others have noted, Google haven't made a habit of locking out accounts for no reason and providing no path to recovery. That's the point: Google wants to collect your digital life and control it. But they also don't want to deal with any requirements to ensure you can actually use or recover it expediently. So it's not "if Google close up shop" it's "due to reasons we've (our AI decided too) ban your account. Don't bother contacting us, as there is no customer service".
        acdha 3y ago
        > This is pretending that, as others have noted, Google haven't made a habit of locking out accounts for no reason and providing no path to recovery No. Other people have posted incorrect claims but repetition doesn’t make them less wrong. If Google locks your account, you lose the ability to add new devices to that account but all of your current devices will still have their synced keys stored on their devices as well as the ability to use other passkeys, recovery codes, etc. If Google locks your account, this is nowhere near the biggest problem you’ll have.

themagician 3y ago

And when it happens to you, Google will let you know that they reserve the terminate your account for any reason or no reason at all. You will get the same email response over and over again: “We have concluded the review of the information you’ve submitted. To prevent possible fraud and abuse, your Google products and services will remain suspended. It is our policy to not discuss the specific reasons for these suspensions. Note that in the Google <PRODUCT> Terms of Service, we reserve the right to change, suspend, or discontinue any aspect of our services at any time, including availability of a service or any feature, without notice and without liability. We also reserve the right to impose limits on certain Service features or restrict access to some or all of the Services without notice and without liability.” It can wreck your life. Getting a suspension lifted can take a truly stupid amount of effort depending on the reason (if you even know it). For me it involved basically stalking employees until I was able to find someone who could actually review my account. Literally looking up employees by department and name on LinkedIn and Twitter, then trying to find their phone number and texting them. I must have sounded crazy. But I was able to find someone to help. Then it took like 5 minutes to fix. It was clear it was just a mistake on their end—an, “overzealous anti-fraud algorithm.” I probably spent around 60 hours in totally trying to get my account restored. After getting access back I stopped using that account and made sure to distribute access to different accounts and emails. Using a single Google account is just way too risky. The more services you use the more likely you are to encounter an account suspending issue. I’ve heard of many cases where people get hacked and Google’s response is to ban the victim permanently. Facebook has similarly atrocious policies.

deleted 3y ago
[deleted]
psychphysic 3y ago
Biggest reason I pay for my own domain and low-cost email (tutanota it's offers custom domains for €12pa).
- themagician 3y ago
  It’s very easy to become complacent. I knew forever that using Google was a risk. I keep email mostly on owned domains… but I also use all sorts of Google services. The thing is, for every Google service you really should have a separate account. One for dev, one for YouTube, one for Gmail, one for Wallet. Maybe one for Chrome if you use it as a password manager. One for AdWords. One for payments if you use any merchant services. Every service you add to an account increases your odds of suspension. Oddly, I’ve also heard that one of the reasons guy can get banned is for having multiple accounts. So I’m not sure if my new policy is any better than my old one.

latexr 3y ago

> google, the company making the big passkey push Google had a recent blog post about it, but the push started with Apple at WWDC22 (and one session at WWDC21), to the point some assumed it was an Apple-only feature. An effort like this requires coordination from major players to take off with the impact they want (replacing passwords). https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fi... 1Password has been tracking services which support passkeys, and so far adoption seems slow. I’ve been checking their website on and off for months and it has hovered at about the same number of websites, occasionally going down. https://passkeys.directory/ https://passkeys.directory/

progbits 3y ago
We had apple passkey posts over the last few months with people salivating over it but suddenly they hear google and suddenly the feature is evil from the start. I'm not defending passkeys but you people need to pick a side to shill for.
- georgyo 3y ago
  Indeed, Apple's passkeys are the in the field of heroic security while Google's is an evil play to take away users power. The flip side here is that Apple gives a user near zero power in their walled garden, and is hostile towards anyone outside of it. So Apple passkeys can't take away user control because they never had any.
  - latexr 3y ago
    You may not believe a statement from Apple, but: https://news.ycombinator.com/item?id=35855113 https://news.ycombinator.com/item?id=35855113
    - admax88qqq 3y ago
      That's not a statement from Apple. That's a statement from an Apple developer. And I have no doubt that he believes it and intends to implement it. But that's not a guarantee that the corporation around him won't decide tomorrow that they don't want to implement it.

gruez 3y ago

>Lose your (google) passkeys account for whatever reason (ai says no, wrongthink, itar ban), and you risk losing your digital life. Isn't this entirely orthogonal to the usage of passkeys? You could "lose your digital life" if you forgot your password, or remembered your password but tripped their risk scoring system (eg. fresh login from an unusual location).

dv_dt 3y ago
You could consider it orthogonal before, but would a passkey store accumulate of many more critical accounts could be attached to that google/apple account. So a mistriggered security or regulatory function could cut off access to the account, followed by being cut off from your bank or other accounts wrapped up on that same passkey store?
- lazide 3y ago
  And DMV and USPS and US State Dept, and a bunch of other places too.
- m-p-3 3y ago
  > So a mistriggered security or regulatory function could cut off access to the account, followed by being cut off from your bank or other accounts wrapped up on that same passkey store? In terms of key, it's either stored at the OS/browser level (Windows Hello), or at the hardware level (Yubikey). Imagine them as if there were SSH key files; You hold the private key(s), protected by a PIN/password and Google simply has the public key(s) to authenticate you. Even if Google disabled the account, it still doesn't block you from using other stored Passkeys that are tied to other providers. The only place where you'd get in trouble is if these third-parties like the DMV used Google as their SSO.
- anonymouskimmer 3y ago
  Just a pet peeve of mine directed at you and the GP. "Orthogonal" - the better word for most circumstances unrelated to math is "unrelated". Depending on the situation, "has nothing to do with" works pretty well too. And to the GP: Since passkeys (and passwords, and etcetera) are related to some extent to one's "digital life", then they cannot be "entirely orthogonal". To really, really nitpick, even in math, orthogonality does not imply unrelatedness. Two objects being orthogonal to each other means that they both are related to the extent they belong to the same coordinate system. I guess, by my standards then, using the phrasing "entirely orthogonal" indicates that you believe that the two things are related to the extent they belong to the same coordinate system, but never meet. I don't like this usage because it seems that "digital life" embodies the entire coordinate system in which "passkeys" exist. Nothing is "orthogonal" to its coordinate system, at most it's orthogonal to an axis in that coordinate system. I'm kind of tired of this nitpicking myself, though. Please don't borrow nomenclature from other fields when already existing nomenclature (or better yet, colloquial terms) work just fine. Thanks.

waboremo 3y ago

Passkeys don't rely on Google though, and your linked project can be used as a roaming authenticator for passkeys.

joecool1029 3y ago

> Edit: If you need MFA please do check out solokey, an open source Fido project. I did, but are they vaporware? Website has not been updated with Solo 2 information, but there's a Kickstarter that claims I can still buy early bird keys that will ship almost 2 years ago? Their github repos haven't had meaningful activity in well over a year: https://github.com/solokeys/ https://github.com/solokeys/

FullyFunctional 3y ago
Hmm, I don’t know the current status but I did receive and use my keys I got from backing. I have also gotten mails about firmware updates, but nothing recently.

chlorion 3y ago

Ah yes, Google can disable my Linux desktop passkey client when they terminate my Google account. I forgot that they had the ability to do this. If only this passkey thing was a Fido standard that could be used with the product you linked us!

crossroadsguy 3y ago

I had to put a huge amount of effort to move away from Google - actually Google nuked the amount and I never knew why (I had no connections at Google, so that didn't work out). So I anyway do not use Google at all. Now I carefully ensure that I am not depending on Apple/iCloud for anything either, because honestly that is just like Google and even though you can reach a human being at Apple, their support (at least in India) seems to be trained to perfection in stone-walling you and denying you even an escalation. So no, I hope this passkey thing is optional or there are third party players (Mozilla?, BitWarden? etc) in this play. And I hope there will always be a recovery option that will be just user's and not with with the passkey provider "by design". But knowing Apple and Google I think they will make it infinitely harder for any third party to become an option on their devices or platform that there won't really be a competition. It would be worse than the case where "iOS has alternative browsers, but not really". I somehow have a bad feeling about this passkey thing unless third party providers get to become, by explicit user permission and setup, A first class citizen of passkey on. a device.

denton-scratch 3y ago
> unless third party providers get to become, by explicit user permission and setup, A first class citizen I'm not keen on handing my identity over to a third-party to manage. And I share the concerns of the commenter up-thread that TLA agencies have fingers in this pie; if they don't, then they're not doing their jobs. I had a go at implementing oAuth and self-hosting it; but part of the problem with (some of) these open protocols is that people with much more time on their hands than you, and with membership on the specification committees, start messing with the protocols and making them much more complicated. That happened to CalDAV - I wrote a CalDAV server, but it was obsolete as soon as it was finished, because the specs had already moved on.

SEJeff 3y ago

I work with several of the original authors of solokeys and can confirm they’re legit and gifted engineers. I own several myself.