3 ms·

Especially for normal and older folks and Google's history of very non-existent support. Not to mention that passkeys is a flawed system as well. [1] [2] [1] h

• gowld 3y ago
  What is the flaw?
  • gcr 3y ago
    AFAICT, the flaw is that passkeys are tied to device security. If I steal a naive person’s phone at the bar, and if I can guess that their PIN is 1234, then I can get into their Google account. The criticism is based on the idea that most non-techie folks are unlikely to use a strong PIN and are unlikely to set up strong biometrics. There’s a related criticism about malware being able to steal passkeys on PC-based systems.
    • kahnclusions 3y ago
      Most people have _extremely_ weak device security. 0000, 1234, DDMM of their birthdate, etc, you probably cover the majority of people. And none of that helps you when someone robs you of your phone and says tell them your unlock code or they’ll stab you. Now they’ve got all your passkeys too.
      • Dlanv 3y ago
        They also have your phone so they have text messages, email access, Google auth access, etc. So yes it is true that your phone and it's pin/biometrics are ultimately the most important thing for security. But passkey on your phone is no worse than the previous state.
    • jackson1442 3y ago
      What are the odds that someone with a passcode 1234 is 1/ already signed into Google on their phone or 2/ has their Google password already saved in the device password manager (since it asks you to save it every time you sign in) which is also protected by the device pin? At least in this case the thief has to steal the physical phone instead of guessing "password123" on the google signin prompt from the comfort of their home. Also- how many non-techy people do you know that avoid using on-device biometrics? On my end, the number is approximately 0.
      • joshspankit 3y ago
        Don’t try to argue that on-device biometrics are a foolproof solution to this. Even at it’s best you can unlock a device from a sleeping (or drunk or naive) user which just brings us back to the same issue: already being logged in to a passkey service.
        • jackson1442 3y ago
          From the parent I responded to, emphasis mine: > The criticism is based on the idea that most non-techie folks are unlikely to use a strong PIN _and are unlikely to set up strong biometrics._ On-device biometrics are typically _also_ used to unlock the device password manager, so my other remarks still apply. I bet a sizeable portion of the HN crowd also uses biometrics to unlock their well-configured password managers on their phone. At least, that's what I personally do. Entering my very strong vault password every [lock duration] on a touch keyboard is already irritating enough; I'd rather just look at my phone to unlock my passwords when I need to use autofill.
      • chownie 3y ago
        > What are the odds that someone with a passcode 1234 is 1/ already signed into Google on their phone ...very high? I don't understand how this is unlikely, pretty much every phone owner with a google account is signed into that account on their phone.
        • zerocrates 3y ago
    • charcircuit 3y ago
      If someone steals my phone and guesses my pin they already have access to my Google account because I'm signed in. To look at my email they just have to click on the gmail app. This "flaw" exists regrardless of password or passkeys
    • true_religion 3y ago
      Won’t most people be logged into their Google account anyways? So if you steal their phone, and guess their PIN then you can just use the already logged in account. What does this change?
      • j-bos 3y ago
        Certain account changing actions cannot be completed without the password. But if you have the phone (session, sms, passkey), you can reset the password and it's off to the races.
        • illiac786 3y ago
          If the person uses a password manager, same result. You have the phone unlocked, you have everything.