Do you people trust companies with passkeys?
I feel like big tech have started pushing for passkeys really hard lately. Microsoft has been asking me if I want to switch to passkeys pretty consistently. Google just automatically brings up the passkey registration fingerprint scan system dialogue every single time I've been signing in on Android. Without even asking if I want a passkey or not, it just does it without saying anything. I think the intention is pretty clear, an unknowing person sees the completely random fingerprint scan dialogue, doesn't think much of it, scans their fingerprint, a passkey gets created automatically.
Well, I fell for their trick. I've been avoiding the passkey dialogue pretty consistently for a while now, but just now I was signing in while distracted and accidentally tapped my finger on the scanner by reflex on the prompt. I guess I have a passkey now. Yay.
I did some digging on my Google account settings and the internet, and I couldnt find a way to completely remove the passkey. It seems you can only disable the use of passkeys, but the passkey itself remains. There is also a setting called "Skip password when possible", which is clearly what has been causing the non-stop passkey prompts. It's on by default. It's a shame I'm only aware of it now that its too late.
Theoretically, the passkey standart itself should be private and secure. Throughout the process, the biometric information used for the cryptographic challenges never leaves the device, and the server only gets access to a signature that has been signed with the client's private keys that it can use to authenticate but can't derive the private keys back from because of complicated math I didn't spend enough energy to understand. Google automatically syncs the passkeys with its private keys with E2EE in the Google Password Manager tied to the account, which is where I start to get uncomfortable because I can't bring myself to trust Google with E2EE.
What do you people think?
Had this a few weeks ago, my partner had her email hacked, she used the same password on a service that was hacked and email/passwords stollen. They first used a ‘forgot password’ on her phone operator account, reported the SIM as lost/stollen and registered her number to a new SIM. Then they could change the passwords on anything they liked as they had her phone number and got the 2FA calls and SMS. They then went through accounts downloading apps and setting up or re-registering MFA once the passwords were changed.
Gotcha. OK so maybe a little less applicable to some more than others.
I already use mostly unique passwords (like a random root word(s) with varying numbers and special characters mixed in) for accounts, and only have my mfa app allowed, not email or SMS. My PW & MFA apps have unique PINs. I also have multiple email aliases for those varying accounts and rotate through after they're sold every so often. Helps cut down on spam A LOT vs manually unsubscribing. Retail sites are especially guilty of selling info IMO.
Mine might be slightly overkill, and maybe less necessary with passkeys, but I'll wait until there are goods self-hosted apps for that.
Yeah you are going far beyond most people, but passkeys will be a major step up for the majority of the population who still use the same or similar passwords for everything.
OK, thank you.