291
Google will now make passkeys the default for personal accounts
(arstechnica.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Oct 2023
291 points (98.0% liked)
Technology
59598 readers
2192 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Use a pair of hardware tokens and a long pin if you want maximum security. If you want to use a sync-able software token do that and set a strong pin.
You like long passwords? Go ahead and put one on your passkeys. You don't have to use a short pin.
It is two factor. Something you have, key in TPM or hardware token, and something you know: the PIN. Or if you choose to enable biometric it shifts to two things you have the: key and your face/fingerprint.
Remember you only have limited attempts to guess the PIN and biometric auth is subject to configurable timeout conditions before the PIN is required.
Any security conscious person will use a strong PIN. Many will choose to use biometrics as well for convenience. Most people are still setting their password to Sm3llyK@t42 on every website. A protected key and a 4-digit pin/finger print is a huge leap in security.
But that's the whole thing we are trying to solve here. We are trying to eliminate human factor and by extension bad habits people have when it comes to security. So expecting people to use good passwords and pins for keys will be the same as expecting people to have good passwords for accounts. Perhaps even worse because of claims it's better security so people might even relax more.
Also timeouts with pins and passwords mean very little once someone has your device. This is why I don't consider it good two-factor. PIN might be in your head, but nothing is preventing someone brute forcing it. Once you image the device you can do whatever you want. With credit cards, you'd need ATM to keep doing it and lockout is a serious problem there.
It's a step in right direction for sure, but I'd prefer if keys didn't depend on PIN or password.
I feel like it's 2001 and I'm trying to convince my users to switch from passwords to RSA keys for SSH. Yes there are potential weaknesses. Yes it's still much better.
Even if all we've done is reduced potential attackers from everyone with an Internet connection to people with physical access to the device we've still massively increased the average user's security. And we've done more than that.
Also unless you can clone the device somehow hitting max guesses and losing access just like an ATM is part of the design.
I lost track of your suggestion over the weekend but what was your suggestion for second factor other than a pin or password?
I didn't have one, I just disliked the idea of having all that's needed for auth in a single device which can be lost.
Thanks for the civil discussion. While my views haven't changed I have learned a lot about possible objections from informed people.
Let's hope this new auth standard is implemented responsibly by all the major parties and that weak passwords and phishing become relics of the past.
Hope is all we can have. Sadly time and time again there were companies who thought the were smarter than others and altered established protocols. Be it Telegram or OAuth with Facebook. But let us hope.