4 ms·

If you can recover an account without the passkey, how much security is it really adding?

• toomuchtodo 3y ago
  Depends on the recovery mechanism. Providing a government credential with a live selfie is the gold standard. If a company doesn't support that, they're being cheap at the cost of security (you can perform such an identity proof for ~$1-2/per successful proof through a vendor like Stripe Identity or ID.me). Passkeys solves for digital identity compromise (credential theft or stuffing/spraying), but you must rely on other mechanisms (such as a I mention above) if you want to elevate identity assurance higher in the event of credential loss. (consumer IAM is a component of my work at a fintech; auth/creds security, passkey rollout, high identity confidence when an account is recovered, etc)
  • vel0city 3y ago
    How do I actually give them my real government document with it's physical security features through the internet? Just take a grainy photo of it? Really secure!
• grotorea 3y ago
  It at least avoids the user being phished or being compromised by reusing passwords. But it seems in this case the account recovery is just using the password so the passkey is mostly convenience and maybe Google trying to move things away from passwords more than a complete change.
  • echelon 3y ago
    > maybe Google trying to move things away from passwords more than a complete change Google wants to be a gateway to everything else you do. The next step is to get other platforms to accept Google passwordless auth.
• kube-system 3y ago
  That depends entirely on how rigorous the recovery process is.