4 ms·

> [Customers] appreciate that [SMS reset is] more convenient than resets via email. Anecdotally, I'm annoyed every time I have to log into a Google account usi

> [Customers] appreciate that [SMS reset is] more convenient than resets via email. Anecdotally, I'm annoyed every time I have to log into a Google account using phone verification, because I have to stand up from my desk and find my phone (which sometimes is in a different room) in order to receive the call/message with the code. TOTP is much more convenient in comparison. I don't have to stand up from my desk, because I store the codes in KeePassXC.

toomuchtodo 3y ago
Create a passkey on each of your devices. https://www.google.com/account/about/passkeys/ https://www.google.com/account/about/passkeys/ https://blog.google/technology/safety-security/passkeys-default-google-accounts/ https://blog.google/technology/safety-security/passkeys-defa... Sites that support Passkeys: https://passkeys.directory/ https://passkeys.directory/
- worthless-trash 3y ago
  A lot of companies still mess up passkeys, Allowing them only as a 1:1, using one terminates the session of another, or in some cases invalidates the previous passkey entirely. Its implementations specific I'm sure, hwoever its not as straight forward as one would hope.
  - lxgr 3y ago
    Also a favorite: "Your browser does not support Passkeys". It sure does, which these horrible sites could easily verify by invoking the single line of JavaScript [1] to learn as much, instead of assuming "Firefox -> must be unsupported". Absolutely infuriating. [1] https://gist.github.com/miguelmota/ad833d2e6f024a7189f8036641640658 https://gist.github.com/miguelmota/ad833d2e6f024a7189f803664...
- chrisfinazzo 3y ago
  Extra security is welcome, but I'm simultaneously terrified that I'll somehow get locked out of my Apple ID or main Gmail account. Everything I read about Passkeys says this scenario is 100% impossible, as it's based on biometrics and no longer using a text string that can get lost, but I'm still nervous AF. I've had to do the "reset a password that's behind 2FA" dance before and it makes me want to crawl in a hole and die - super duper scary. Somebody tell me to chill out.
  - deleted 3y ago
    [deleted]
- hedora 3y ago
  Hard pass. What if I lose all my devices? (Except a fireproof offsite box with a piece of paper containing most of my passwords in it.) More realistically, what if Google decides to disable my account, and holds my passkey database hostage (which they can, by design)?
  - toomuchtodo 3y ago
    Note I said “each of your devices.” Even if Google locks you out, they are all still on at least one of your devices (if not more). My passkeys are shared with family members in iCloud (where they are synced to) for bus factor. I don’t recommend using Google for any consumer services if you can avoid it, especially syncing your password/passkey database, as there is zero support if something goes wrong.
    - janpieterz 3y ago
      There are stories of Apple locking users out of their iCloud accounts.
      - toomuchtodo 3y ago
        And all of your passkeys should still be on each device in such a case. It’s sync, not a singular vault.
        janpieterz 3y ago
        If you still have access to them, yes. Problem is if you don't. And we need to be mindful that it's easy for us to say these things being very digitally native, while there's a huge part of the population that isn't so digitally aware and relies on companies like Apple to "make everything work".
        toomuchtodo 3y ago
        I don’t disagree. It’s why the FTC and other federal regulatory agencies should require some sort of identity bootstrap process if you lose all of your digital identity credentials. I’ve submitted comments to this effect to the FTC, and I’d encourage others to as well. Email (where all roads currently lead) should not be your identity in the 21st century, and losing a device or Big Tech account shouldn’t permanently banish you from digital account access. Some relevant comments I've written on the topic in this thread: https://news.ycombinator.com/item?id=38691082 https://news.ycombinator.com/item?id=38691082 | https://news.ycombinator.com/item?id=38691156 https://news.ycombinator.com/item?id=38691156
garciansmith 3y ago
You can click the "try another way" link, which will allow you to use a TOTP code (which they call the "Get a verification code from the Google Authenticator app" option even if you've never used Authenticator).
- AnonC 3y ago
  I don’t have experience with TOTP on this, but I’ve seen that the “try another way” doesn’t even work with a recovery email address and a code sent to it. Google seems to make it almost impossible to login if you move away from your “home” location, unless perhaps you use its apps and are already logged in.
kalleboo 3y ago
In the Apple ecosystem, the SMS syncs to your Mac, Safari detects the code and autofills it in the web page, and then it auto-deletes the SMS when you're done for you. It couldn't be more seamless.
- rrr_oh_man 3y ago
  Which, ironically, requires you to forever "opt-in" to 2FA on your Apple ID.

toomuchtodo 3y ago

Create a passkey on each of your devices. https://www.google.com/account/about/passkeys/ https://www.google.com/account/about/passkeys/ https://blog.google/technology/safety-security/passkeys-default-google-accounts/ https://blog.google/technology/safety-security/passkeys-defa... Sites that support Passkeys: https://passkeys.directory/ https://passkeys.directory/

worthless-trash 3y ago
A lot of companies still mess up passkeys, Allowing them only as a 1:1, using one terminates the session of another, or in some cases invalidates the previous passkey entirely. Its implementations specific I'm sure, hwoever its not as straight forward as one would hope.
- lxgr 3y ago
  Also a favorite: "Your browser does not support Passkeys". It sure does, which these horrible sites could easily verify by invoking the single line of JavaScript [1] to learn as much, instead of assuming "Firefox -> must be unsupported". Absolutely infuriating. [1] https://gist.github.com/miguelmota/ad833d2e6f024a7189f8036641640658 https://gist.github.com/miguelmota/ad833d2e6f024a7189f803664...
chrisfinazzo 3y ago
Extra security is welcome, but I'm simultaneously terrified that I'll somehow get locked out of my Apple ID or main Gmail account. Everything I read about Passkeys says this scenario is 100% impossible, as it's based on biometrics and no longer using a text string that can get lost, but I'm still nervous AF. I've had to do the "reset a password that's behind 2FA" dance before and it makes me want to crawl in a hole and die - super duper scary. Somebody tell me to chill out.
- deleted 3y ago
  [deleted]
hedora 3y ago
Hard pass. What if I lose all my devices? (Except a fireproof offsite box with a piece of paper containing most of my passwords in it.) More realistically, what if Google decides to disable my account, and holds my passkey database hostage (which they can, by design)?
- toomuchtodo 3y ago
  Note I said “each of your devices.” Even if Google locks you out, they are all still on at least one of your devices (if not more). My passkeys are shared with family members in iCloud (where they are synced to) for bus factor. I don’t recommend using Google for any consumer services if you can avoid it, especially syncing your password/passkey database, as there is zero support if something goes wrong.
  - janpieterz 3y ago
    There are stories of Apple locking users out of their iCloud accounts.
    - toomuchtodo 3y ago
      And all of your passkeys should still be on each device in such a case. It’s sync, not a singular vault.
      - janpieterz 3y ago
        If you still have access to them, yes. Problem is if you don't. And we need to be mindful that it's easy for us to say these things being very digitally native, while there's a huge part of the population that isn't so digitally aware and relies on companies like Apple to "make everything work".
        toomuchtodo 3y ago
        I don’t disagree. It’s why the FTC and other federal regulatory agencies should require some sort of identity bootstrap process if you lose all of your digital identity credentials. I’ve submitted comments to this effect to the FTC, and I’d encourage others to as well. Email (where all roads currently lead) should not be your identity in the 21st century, and losing a device or Big Tech account shouldn’t permanently banish you from digital account access. Some relevant comments I've written on the topic in this thread: https://news.ycombinator.com/item?id=38691082 https://news.ycombinator.com/item?id=38691082 | https://news.ycombinator.com/item?id=38691156 https://news.ycombinator.com/item?id=38691156

garciansmith 3y ago

You can click the "try another way" link, which will allow you to use a TOTP code (which they call the "Get a verification code from the Google Authenticator app" option even if you've never used Authenticator).

AnonC 3y ago
I don’t have experience with TOTP on this, but I’ve seen that the “try another way” doesn’t even work with a recovery email address and a code sent to it. Google seems to make it almost impossible to login if you move away from your “home” location, unless perhaps you use its apps and are already logged in.

kalleboo 3y ago

In the Apple ecosystem, the SMS syncs to your Mac, Safari detects the code and autofills it in the web page, and then it auto-deletes the SMS when you're done for you. It couldn't be more seamless.

rrr_oh_man 3y ago
Which, ironically, requires you to forever "opt-in" to 2FA on your Apple ID.