12 ms·

As a user I still don't understand this. What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I l

• jjav 3y ago
  > What happens if there's a house fire or something and all my devices where I'm logged in with Google break? How do I log into my account again? Easy: you will never log in to google again. Since google has zero reachable support, that's the end of your account. This works better with something like a credit union where as a last resort just can just walk in there in person with IDs and restore access. But with these internet giant companies which take pride in not having any reachable support ever? Nope, nope and no.
• konschubert 3y ago
  And what if somebody breaks into my google/iCloud account and syncs all my passkeys to their machines?
  • px43 3y ago
    If they're in your Google/iCloud, you're already in a game over scenario. The point of all this is to prevent that from happening. You can try to recover by revoking all your passkeys and starting over with hardware tokens, but that's likely what a sophisticated attacker is going to try as well, and they're probably faster than you. Still way way better than passwords.
    • konschubert 3y ago
      If they break into my iCloud then they’re in my iCloud. They’re not in all my other accounts, because I use an encrypted password manager that isn’t iCloud.
      • skarra 3y ago
        Think of it as using iCloud as your password manager and storing your OTPs - someone breaks into your iCloud, they get access to all the passwords and OTPs to login to any service in iCloud. Always take the security of your password manager / sync accounts seriously. Use hardwre security keys if needed on the "root accounts".
        • lxgr 3y ago
          iCloud is unfortunately impossible to adequately secure for that use case. If you shoulder-surf somebody's phone unlock PIN and grab their phone, you have everything you need to take over their iCloud account, including their passkeys and the capability of locking out all of the victim's other trusted Apple devices and changing their iCloud password. This was very surprising for me to witness first hand – fortunately not in the identity theft scenario, but only when observing a relative regaining access to their iCloud account using only their iPad they were logged in on.
          • skarra 3y ago
            It is a fair observation. And I can see why users tend to be alarmed about this. Although in my experience users tend to significantly underestimate the real risks of online attacks relative to these more visceral threats. Let met ask you: has that discovery made you stop using your iPhone, or storing passwords or other critical data in your iCloud? If the answer is "No", then you're strictly better off moving to passkeys stored on iCloud as well.
            • lxgr 3y ago
              > Let met ask you: has that discovery made you stop using your iPhone, or storing passwords or other critical data in your iCloud? Yes, it has (the latter). I was a big fan of (non-synchronized) on-device passkeys, but this has significantly changed the threat model for me. I use a third-party password manager exclusively now, and I'll probably be using its synchronized Passkey implementation too if it turns out to be any good. As soon as Apple starts offering a different set of security trade-offs (e.g. make usage of the recovery key mandatory when resetting my iCloud password, or at least implement a timed lockout), I'd gladly start using iCloud Passkeys and maybe also its password manager.
    • 13415 3y ago
      How is that better than passwords? I backup my encrypted passphrase database to a cloud provider. When my house burns down and all my devices are lost, I get a new device, download my own passphrase manager app, download the passphrase document, and continue as before. If someone breaks into the cloud provider and downloads my passphrase document, nothing happens.
  • ngrilly 3y ago
    The passkeys are encrypted before leaving your machine and Google/iCloud are only storing the encrypted passkeys and can't decrypt them.
    • konschubert 3y ago
      Presumably encrypted with e.g. my iCloud password ?
      • ngrilly 3y ago
        Kind of, but it's more complicated than that. Details there (and in the link at then bottom of the page): https://support.apple.com/en-us/102195 https://support.apple.com/en-us/102195
• betaby 3y ago
  You don't.
  • hooverd 3y ago
    That's the great part.
    • deleted 3y ago
      [deleted]
• frabcus 3y ago
  To add, it is pretty poor there is no FAQ linked to from that post to answer basic non-technical questions as to how this is intended to be used. I assume as a technical person, the answer is I should have a backup device with a friend and/or store my passkeys somehow on my Apple or Microsoft or password manager account as well. But it needs more explanation in detail from Google!
  • deleted 3y ago
    [deleted]
  • evanjrowley 3y ago
    You have a valid concern, but I'm curious how many sufficiently non-technical users would be reading Google's blog. Practically speaking, it could be a moot point.
  • skarra 3y ago
    You can try this: https://support.google.com/accounts/answer/13548313?hl=en https://support.google.com/accounts/answer/13548313?hl=en, this help center page is linked to from various parts of the product experience for regular users to get a better idea about passkeys if they are interseted.
    • pseudalopex 3y ago
      The page did not answer the questions they asked.
  • dotancohen 3y ago
    So now that "friend" has access to your account? How is that more secure than my 32 random character password I store in an encrypted Keepass database that I back up offline?
• growse 3y ago
  You go through.... account recovery? Like if you lose your password today?
  • ses1984 3y ago
    If you can recover an account without the passkey, how much security is it really adding?
    • toomuchtodo 3y ago
      Depends on the recovery mechanism. Providing a government credential with a live selfie is the gold standard. If a company doesn't support that, they're being cheap at the cost of security (you can perform such an identity proof for ~$1-2/per successful proof through a vendor like Stripe Identity or ID.me). Passkeys solves for digital identity compromise (credential theft or stuffing/spraying), but you must rely on other mechanisms (such as a I mention above) if you want to elevate identity assurance higher in the event of credential loss. (consumer IAM is a component of my work at a fintech; auth/creds security, passkey rollout, high identity confidence when an account is recovered, etc)
      • vel0city 3y ago
        How do I actually give them my real government document with it's physical security features through the internet? Just take a grainy photo of it? Really secure!
    • grotorea 3y ago
      It at least avoids the user being phished or being compromised by reusing passwords. But it seems in this case the account recovery is just using the password so the passkey is mostly convenience and maybe Google trying to move things away from passwords more than a complete change.
      • echelon 3y ago
        > maybe Google trying to move things away from passwords more than a complete change Google wants to be a gateway to everything else you do. The next step is to get other platforms to accept Google passwordless auth.
• toomuchtodo 3y ago
  Passkeys are typically synced to cloud storage.
  • sneak 3y ago
    Not just typically - on iOS, you cannot use them at all without iCloud enabled.
    • fbdab103 3y ago
      Perfect! I keep iCloud off, so this is one "improvement" I can continue to sidestep for a while.
    • fh9302 3y ago
      On iOS you can use third party software to manage passkeys, there is no inherent cloud requirement.
      • sneak 3y ago
        Can you? If so, this is great news. What apps support this?
        • fh9302 3y ago
          Third-party passkey providers got added with iOS 17. I don't know which apps apart from 1Password support it yet but the API is there.
      • gruez 3y ago
        Source? >Note: To use passkeys, iOS 16, iPadOS 16, macOS 13, or tvOS 16 (or later) is required. iCloud Keychain and two-factor authentication must also be turned on. https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios https://support.apple.com/guide/iphone/use-passkeys-to-sign-...
        • fh9302 3y ago
• jkaplowitz 3y ago
  I think you’ll still need a password on your account for cases where no passkey is available, and possibly for other scenarios of heightened fraud risk. That’s why the setting they’re describing in the blog post is named “Skip password when possible”. Disclaimer: although I worked for Google many years ago in a role entirely unrelated to Google account authentication, I have no inside info on this announcement, could be wrong about what I say in the first sentence of this comment, and am not speaking for Google here.
  • goosedragons 3y ago
    I think there's going to be an issue with people forgetting passwords they lasted used 5 years ago. Recovery needs to be much better thought out.
    • jkaplowitz 3y ago
      I agree that recovery is an important question. Maybe they will make sure to prompt for a password at least every N months? I have no idea what their answer for this may be, but they probably have one.
  • vdelitz 3y ago
    I also think that for sign-ups you still need a password for a while (simply as a fallback)
  • skarra 3y ago
    You're spot on. And I work on the Google authentication team right now :)
• grotorea 3y ago
  > What is the account recovery process if I’m locked out and don’t have my phone, say it’s lost or broken and I can’t verify my identity? > You can always fall back to legacy authentication options such as passwords and traditional 2-step-verification. In a case where you can no longer remember your password, you can also go through Google’s Account recovery flow. We encourage you to add your email and phone number to ensure you can always access your account. > https://safety.google/authentication/passkey/ https://safety.google/authentication/passkey/
  • chupaolo 3y ago
    Then what's the point of it all if a hacker can still get into my account using the traditional methods? This seems to be just opening up another avenue of attack.
    • skarra 3y ago
      You can read more about the security properties of passkeys on your Google account on this post from earlier this year when support was originally announced: https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html https://security.googleblog.com/2023/05/so-long-passwords-th...
    • px43 3y ago
      My Google account is set up such that account recovery requires me to actually travel to Mountain View and present several forms of ID, and that's just how I want it to be.
      • lxgr 3y ago
        Are you joking or does Google really do in-person verification for high-value accounts (e.g. GCP or Play Store developer accounts)?
    • grotorea 3y ago
      If I understand it correctly it will avoid phishing, assuming people notice there's something up when they see a page asking for a traditional login for no good reason when they have passkeys. And it may be a transitionary step towards no passwords or something.
• Anduia 3y ago
  When you get a duplicate of your SIM card you can then verify it is you with a SMS code. There are also security questions and alternate email you can configure just in case.
• teeray 3y ago
  Well you just get in touch with a friendly Google customer support representative /s
• deleted 3y ago
  [deleted]
• shinycode 3y ago
  And if I loose for some reason access to my phone number, termination of current number to create a new line with a new phone, I loose access to Gmail forever ?
  • DerekL 3y ago
    * lose
  • init2null 3y ago
    Possibly. Security has made internet enabled accounts outright user hostile. Try helping a 70 year old guy get into his Gmail again. I despair over the disrespect Google and the other major internet corps show their tech-naive users. I've heard "I'll call them" far too often, and am perpetually forced to share the bad news.
• NorwegianDude 3y ago
  You get a new device, load your keys from the cloud and use the same screen lock key to decrypt the downloaded keys. Even if it's passwordless by default doesn't mean there is no passwords for recovery.
• qingcharles 3y ago
  I had a fire. I lost every single thing I own, except my landlord grabbed my phone, bless him. Otherwise I would have been totally stuck as all my TOTP apps are on there. Also, never lose your phone number. I can't get back into my Google account even though I have the username, password and recovery email because I can never get the SMS code.
  • Macha 3y ago
    Have had to recover from 0 pretty similarly. My backup approach basically started with the fact that I knew the password to a cloud storage account that I had uploaded a keepass vault to, and that keepass vault had the password to my primary backup provider. In a full no passwords world, I would have had no chance to do so.
    • qingcharles 3y ago
      Lucky break there! It makes you re-work your entire security setup though, I tell you. I'm a bit smarter now for having that happen to me.
  • zb3 3y ago
    In my country my phone number is linked to my government issued ID so I don't need any physical properties to recover it (this might take some time though but for me it's still the best option).
  • TheNewsIsHere 3y ago
    > Also, never lose your phone number. I can't get back into my Google account even though I have the username, password and recovery email because I can never get the SMS code. This is an excellent point. Google seems to be uninterested in addressing this transparently, but despite their push for phishing-resistant MFA and first factor sign-in options, they still consider a phone number to be golden evidence. My father changed his phone number last year and never updated his Google account. Despite having a recovery email address he could access, TOTP, and printed backup codes, it was not enough. Google wanted to “verify it really was him” after a move (and IP address change) and it doesn’t even allow a password reset to be authenticated with any other recovery option. Phone number or bust.
• kseifried 3y ago
  Updated my paper: https://news.ycombinator.com/item?id=37833390 https://news.ycombinator.com/item?id=37833390 Scenarios dealing with the loss of Passkeys: The scenarios for dealing with the loss of Passkeys are effectively the same as dealing with the loss of your Password Manager (if you use one) or otherwise stored passwords. Dealing with the loss of all your devices that use Passkeys If you manage to lose access to all your devices that are used to authenticate via Passkeys (e.g., a house fire), then there are two main outcomes: either you have your Passkeys synchronized to a cloud provider or other external entity that still has a copy of all your Passkeys, or you do not. If you do not have a backup of all your Passkeys, they are gone, and you will need to fall back to account recovery for each affected account. If you have a backup of your Passkeys, you would need to regain access to it on a new device and then synchronize the Passkeys to it and use them as normal. Dealing with the loss of your accounts that synchronize and store Passkeys If you use a synchronization service attached to an account, it is possible that the account can be deleted or access to it otherwise lost. In this event, you would most likely still have a working copy of your Passkeys on your devices, and depending on whether or not you can export them or reconfigure synchronization with a new account, you would be able to add them to a new account, effectively creating a new account to store and synchronize your Passkeys. Dealing with the loss of all your Passkeys If your Passkey account is not only deleted but also tells all your devices to delete the Passkeys, or you lose all your devices and the accounts are deleted due to inactivity then you are basically in the same situation as having lost all your devices and not having a backup. You will need to fall back to account recovery for each affected account.
  • secabeen 3y ago
    This is accurate, but by putting your passkey backup with that external entity, you are putting all your keys in that basket. Passwords have an obvious, backup option with zero dependencies on third-parties: A printed list in a fire safe. I would not advise users go heavily with any passkey provider that does not provide a physical backup of a similar form that can be secured through non-technical means, and that can be used by an heir or attorney to act as you when you are unable to do so.
    • 3y ago
• segmondy 3y ago
  I don't know how Google solved this, but it's an old solution. Shamir secret sharing. You break apart your keys into M pieces, where you need N pieces to reconstruct the key, so let's say 3/8. Then you need 3 pieces out of the 8 pieces it's broken into to recover your key. You take each of those 8 pieces and give to trusted sources. When you need to reconstruct your key, you have at least 3 of those give you the key and you recover. How does this look in implementation. When I Implemented this in multipasskey (YC demo). It would ask you to select contacts you trusted. Then it would send the sharded parts of the key in the background to them. If you need to recover, you make a request to them. It would reconstruct your device key when you got enough pieces. Once you have your device key, it would download your encrypted backup of keys from the remove server and you are back as new. I called my project multipasskey in 2017/2018 and applied to YC with a working demo and they said nope. I'm going to assume that I sucked at selling it. ;-)
  • bojo 3y ago
    I had the same idea about a decade ago but never bothered to try to implement it. I felt like it would have suffered from the same problem all other technologies have in security: overly complex user interactions. The concept makes sense, but getting N other people to commit is overhead the average user probably doesn't want to deal with.
    • segmondy 3y ago
      So I preferred the idea of regular folks for backup, for security reasons. I thought of the idea of professional users like say your bank or 3rd party. The issue is that it's far easier for the govt to subpoena those pro 3rd parties and recover your key. Whereas, they would have to know which of your friends you used for key recovery to be able to do that. The idea was to make it tough for a bad/powerful actor to steal your key. Of course, the challenge is that a non social person would need friends or to depend on ISPs, banks (pro 3rd party providers). My goal besides security when building this project was to break the chain of 3rd party auths (Google, MS, Github, etc) :-(. They use their auth as a way to lock folks into their ecosystem and if you offend them in anyway, you could lose access to everything. Offend Google on adsense and lose your personal photos/email. Offend Amazon on sales and lose your prime streaming/AWS access. Hopefully as the idea picks up, the monopolistic corps can be tackled again to remove such power.
• skarra 3y ago
  Passkeys are a new technology and everyone - including users, service providers, and organizations - will take time to learn and adapt. In this interim period the recommended approach is to provide passkeys as an alternative to whatever is already offered. This is the approach that Google and many other service providers are taking. That said, you are bringing up the right questions on the general topic of account recovery that everyone should be asking even without passkeys: "How would I login if I forget my password / lose access to my password manager / lose my second factor devices" and have a plan. Introduction and adoption of passkeys do not completely eliminate the need for thinking about your account recovery situation. However, there is one special case where using passkeys is actually better for account recovery. If you create passkeys for your Google account on an Apple device with iCloud keychain, the passkeys are synched to your iCloud, so now even if you lose all your devices because your house burned down, as long as you have access to your iCloud account, you can just get all the passkeys for your Google accounts(and other websites). Now, you may ask: 'what if I lose access to my Apple iCloud account" -> that's a fair question! Which is why I said Account Recovery concerns do not completely go away - but they can be significantly reduced with passkeys in many cases.
  • pseudalopex 3y ago
    You should disclose your employer more consistently.
    • skarra 3y ago
      I work on Google's authentication team. I have mentioned this elsewhere in the thread.
      • pseudalopex 3y ago
        Your other disclosure is why I said more consistently. Do you believe all readers will read all comments and index mentally by user name?
  • CogitoCogito 3y ago
    > That said, you are bringing up the right questions on the general topic of account recovery that everyone should be asking even without passkeys: "How would I login if I forget my password / lose access to my password manager / lose my second factor devices" and have a plan. Introduction and adoption of passkeys do not completely eliminate the need for thinking about your account recovery situation. Talk about victim blaming. Google and other companies introduce policies that make total identity lockout both easier and more problematic. Instead of investing in customer service to deal with this issue, the customer needs to "have a plan". What a crazy coincidence that this policy increases Google's profitability by decreasing support.
• havnagiggle 3y ago
  Just happened to my in-law. She dropped her phone on the stairs, screen cracked, and became unresponsive. I gave her an older phone I had and swapped the sim fine. But she couldn't figure out how to log in to Google account because it was so adamant telling her to use her phone. Her laptop was logged out of her email, etc. Fortunately I have backup tokens for her from a previous incident heh. I have no idea what other folks will do.
  • Msw242 3y ago
    Get a lockbox at the bank
  • hn_throwaway_99 3y ago
    I'm don't know the specifics of how passkeys with Google work, but don't they usually require multiple synced devices?
  • hansvm 3y ago
    A few months ago Google wouldn't even accept backup tokens for me. I was on vacation, and that tripped enough fraud detectors to cause problems. I couldn't log back in till I got on my home network and changed my password.
    • nre 3y ago
      Back in the old days with no 2FA and only username/password access geolocation lockouts happened every time I went travelling. You could regain access by getting a code from a recovery email, but that often got locked out as well! Eventually I set up my own VPN server so that the services still thought I was using my home IP.
• amf12 3y ago
  Passkeys are instead of the password. You can still login using your password. This way, you don't have to keep entering your password if you have access to a device with a passkey and can access that device.
  • lxgr 3y ago
    Passkeys don't (only) replace passwords – they usually also replace another authentication factor as well. That other factor might still be available for account recoveries (together with a password or recovery email etc.), but if either are not regularly exercised, users might forget them or lose access to them and not notice until they also lose access to their passkey(s). That said, Google's and Apple's passkey solutions themselves are cloud-synced (with no way to opt out), so as long as users of either can still access their Google or Apple account, they would not be totally locked out.
  • fatfingerd 3y ago
    Sure, but is that adequate? Not having people practice their passwords seems to be an anti-pattern for selling premium support in password managers, while many other apps ask with planned frequency.
• rcarr 3y ago
  A lot of services, but not all, will let you add passkeys which are tied to a password manager (e.g 1password) and not a physical device. If you've got one of those set up, you can download it on a new device and then gain access that way. In the case of 1password, this means you either have to remember your master password and your access key, or you have to have this stored somewhere safe. Perhaps choose a memorable password[1] and then encrypt an sd card and use one of these[2] in your wallet or a keyring usb drive or a yubikey so in the event of a fire all you have to do is grab your wallet or keys and you're good to go. Alternatively you could store this information in a safety deposit box, or with a trusted relative, or even your lawyer if they offer such a service. At the end of the day, it's the individual's responsibility to determine how much they value their digital security and take what they deem to be the necessary steps, expenses and precautions to protect it. The only other alternative would be for Big Tech to have some kind of integration with the state, so that your digital accounts are tied to something like your passport or social security number, so that there are procedures available for regaining your digital identities in the event of catastrophe, just like you can do with your physical identity. I personally think that the latter is where we are heading, not necessarily because of scenarios like you've mentioned, but because it's only a matter of time until AI advances to the point where it's going to cause a dangerous breakdown in trust and the only way it's going to be fixable is with some kind of system that is tied to physical reality. The internet will end up splitting into two, with the majority spending their time on the "verified" web, which will be websites using OAuth that will require you to use an account with one of the big providers who will have verified with the government or third party agency who you actually are. And then any websites that don't require this will form a sort of new, more accessible "dark web". I honestly think the majority of people are feeling that wary and weary of the internet at this point that they will happily choose the verified web, regardless of the surveillance implications. [1] https://xkcd.com/936/ https://xkcd.com/936/ [2] https://amzn.eu/d/ia3kFeJ https://amzn.eu/d/ia3kFeJ