291
Google will now make passkeys the default for personal accounts
(arstechnica.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Oct 2023
291 points (98.0% liked)
Technology
59414 readers
1324 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Man, the amount of fearmongering and anti-Google rhetoric in this thread makes me sad. Passkeys are almost entirely a good thing and are supported by many big and small companies.
No, it won’t lock you into Google, it’s an open web standard. Google will have an Authenticator, Apple will, and third parties will spring up to support it as well. And there’s no lock in, you can get a new passkey when you want to switch devices or providers.
No, someone who gets access to your device can’t get access to everything if you have basic security hygeine. Secure your passkeys with a secondary password or use biometric authentication.
Yes, it’s almost a straight upgrade to text passwords. They are immune to phishing attacks and other social engineering tricks, and you don’t need to remember long strings of numbers and letters anymore.
Do your research people, sheesh.
The problem with passkeys is that surrender of a physical key is not protected by the 4th amendment and subject to seizure. From a security perspective, I agree that passkeys are good. But I only use a physical key as a secondary factor. Never a primary.
The courts have ruled that you can't be forced to give up a password or passcode. (We'll have to see if the current court will keep this precedent.)
Until we get better privacy protections, I'm not trusting passkeys whole cloth.
My understanding is that, currently, a PIN or password is protected. So if you secure your phone with one of those, access to it is under 4th amendment protection. Given this, I'm curious how passkey legality would work out since it's a physical key, but access to use it would still require a knowledge element.
Passkeys will not protect you against the government.
As I said elsewhere, it's for web services. The web service provider will have to surrender your data on a court order. They can decouple it from the passkey. The passkey doesn't encrypt your data at the provider, it's only used for authentication.
If you really want to protect your data, you will need to use a different encryption solution. Something like full disk encryption with a complex pass phrase.