4 ms·
> The only reason why Big Tech have hyped up Passkeys this much I can't think of any other reason Big Tech (and small tech, and medium tech, government, and th
by nullindividual 3y ago
> The only reason why Big Tech have hyped up Passkeys this much
I can't think of any other reason Big Tech (and small tech, and medium tech, government, and the list goes on) would want to eliminate passwords, an insecure concept, to replace them with a form of proof of ownership.
> [not pasting full quote because ...] "And developers and users... ― Google"
> No, they do not! - Author
Certainly, many developers hate all of the reasons outlined by the quote from the ethereal identity known as the "Google". Many users hate them for the same reason, too, but for some reason the author doesn't believe that developers or users dislike the UX, security, or liability of passwords (the Author, here, is apparently speaking for upwards of 8 billion individuals -- as one of them, I can certainly make up my own mind, thanks).
> Passkeys also makes you more vulnerable to seizures of electronics and keys.
This is why it is important for devices, like the iPhone, have a quick way of putting themselves into a 'locked, require pin/pass' mode. Or just don't enable Face ID/similar biometrics for a 'master' password.
> And when it happens to you, Google will let you know that they reserve the right to terminate your account for any reason or no reason at all.
The ethereal Google can look at you funny and decide they will lock your account without any reason. I'm not sure what makes this situation any different. People commonly use their Chrome account, or Microsoft account, etc. in conjunction with the OS/browser's password manager. With passkeys, they're effectively in a _no worse_ state than they are today. If you want to argue about backups, these are likely the same individuals who wouldn't know why you'd need a backup to begin with.
FWIW, I agree that there shouldn't be vendor lock-in with any form of identity, but there doesn't seem to be a challenger that is willing to bring something forward that eliminates both the security nightmares that are passwords as well as being highly portable with no vendor tie-in which finally, is easy to use. Big Tech found "secure" and "easy to use" which is what users are going to flock to.
- hooverd 3y agoI think Passkeys are a great idea utterly ruined by vendors licking their chops over locking users in and creeping remote attestation.
- CharlesW 3y agoHow am I “locked in” when I can use a different passkey manager whenever I want, just like I can use a different password manager whenever I want? How does a passkey differ from a password from an attestation POV?
- hooverd 3y agoWell, currently, you can export your passwords between your new password managers. You may be able to do that with passkeys. Also, passwords don't have rejecting [optionally, for now] non FIDO certified devices as a part of the spec. You'll have to use a Trusted(tm) passkey manager.
- CharlesW 3y agoFair enough — I've never done a bulk dump of my usernames/passwords, but I can understand how that's a problem for who do (until there's a common passkey interchange format, at least). One aspect of passkeys that may offset the impact of this is the ability to have multiple passkeys for an account, which isn't possible with passwords. > Also, passwords don't have rejecting [optionally, for now] non FIDO certified devices as a part of the spec. You'll have to use a Trusted(tm) passkey manager. Sorry, I may not be parsing this correctly: Are you saying that security requirements for pass[word|key] managers is bad? Or are you saying that they're bad because it means open-source solutions can't support passkeys, as @Ridj48dhsnsh suggests?
- aftbit 3y agoAIUI the concern is that you will only be able to use Passkeys that are held on devices that have been blessed. You will never get your custom solution blessed, so your access to your bank and government services will become dependent on being in good standing with Google. If your Google account gets deleted or your phone gets remotely deprovisioned, you will be unable to authenticate, and any attempt to create a "backup" against this situation that is fully under your control will be blocked by the attestation requirements.
- 3y ago
- Ridj48dhsnsh 3y agoI could not disagree more strongly. Giving large corporations (and governments effectively) the power to control my access to 3rd party resources is totally unacceptable.
- growse 3y agoSo don't use them. Buy a yubikey and use that instead (or whatever). Passkeys are just webauthn, with more standardised flows around them.