Passwordless Google Accounts Are Here - You Can Now Switch To Passkey-Only (arstechnica.com) 72
Google is taking a big step toward our supposedly passwordless future by enabling passkey-only Google accounts. From a report: In the blog post, titled "The beginning of the end of the password," Google says: "We've begun rolling out support for passkeys across Google Accounts on all major platforms. They'll be an additional option that people can use to sign in, alongside passwords, 2-Step Verification (2SV), etc." Previously, you've been able to use a passkey with a Google account as part of two-factor authentication, but that was always in addition to a password. Now it's possible to use a Google account with a passkey instead of a password.
A passkey, if you haven't heard of the new authentication method, is a new way to log in to apps and websites and may someday replace a password. Password entry began as a simple text box for humans, and those text boxes slowly had automation and complication bolted onto them as the desire for higher security arrived. While you used to type a remembered word into a password field, today, the right way to use a password is to have a password manager paste a random string of characters into the password box. Since few of us physically type in our passwords, passkeys remove the password box. Passkeys have your operating system directly swap public-private keypairs -- the "WebAuthn" standard -- with a website, and that's how you get authenticated. Google's demo of how this will work on a phone looks great -- the usual box asks for your Google username, then instead of a password, it asks for a fingerprint, which unlocks the passkey system, and you're logged in. Google's passwordless support is headed for consumer devices right now, while business Google Workspace accounts will "soon" have the option to enable passkeys for end users.
A passkey, if you haven't heard of the new authentication method, is a new way to log in to apps and websites and may someday replace a password. Password entry began as a simple text box for humans, and those text boxes slowly had automation and complication bolted onto them as the desire for higher security arrived. While you used to type a remembered word into a password field, today, the right way to use a password is to have a password manager paste a random string of characters into the password box. Since few of us physically type in our passwords, passkeys remove the password box. Passkeys have your operating system directly swap public-private keypairs -- the "WebAuthn" standard -- with a website, and that's how you get authenticated. Google's demo of how this will work on a phone looks great -- the usual box asks for your Google username, then instead of a password, it asks for a fingerprint, which unlocks the passkey system, and you're logged in. Google's passwordless support is headed for consumer devices right now, while business Google Workspace accounts will "soon" have the option to enable passkeys for end users.
What could go wrong using the same biometrics? (Score:2)
Re: (Score:2)
Given how many people use the same password on multiple accounts, biometrics won't be any worse.
This "passkey" is less secure than a good password-per-site plus a second factor of course. But it will be more secure than the mediocre passwords that many folks use, and it will be easier to use. So I'm cautiously optimistic about this.
Re:What could go wrong using the same biometrics? (Score:5, Interesting)
To quote the FIDO Alliance page, passkeys are "synced to all the user’s other devices running the same OS platform" [emphasis ours].
All well and good if you are like that, but my phone is Android, work computer Windows, and home desktop Tumbleweed. This sounds like I will have a royal pain in the ass. Not only that, my desktop doesn't have biometrics and its out of the way on the work laptop, and I am not trusting the iPod with ability to view porn online as a security device.
Re:What could go wrong using the same biometrics? (Score:5, Insightful)
Given how many people use the same password on multiple accounts, biometrics won't be any worse.
Even with reuse, a password can still be changed in some emergency situation - even if it involves effort and can be a bit of a pain (intellectually). What if you find you need to change your fingerprints? Even if you could, the pain wouldn't be limited to the intellect...
Re: (Score:2)
Re: (Score:2)
Well, if you are going for silly scenarios like that, all they need to do is change the finger they use. If someone magically find a way to mimic your thumbprints and get into the phone, just change the other thumb. That gets hacked, you have 8 other fingers.
Re: (Score:2)
That gets hacked, you have 8 other fingers
Not common knowledge, but run outta those and there are a few more dangly bits you can use.
Re: (Score:3)
Drink one glass of anything and 5 of the 10 available prints are captured in one go.
Re: (Score:2)
At the airport I regularly do work for, most of the newer security points require workers to tap their badge and put their index finger on the fingerprint scanner. That routinely fails, and if it keeps failing after cleaning the scanner, the security guard asks you to switch to the other index finger, which usually works. I wonder if all these web fingerprints will fail as often, or if maybe they're le
Re: (Score:2)
Since it uses your phone or laptop, and the fingerprint scanners on my phone and laptop seem to work 95% of the time (and a second attempt works if the first one failed), I assume it will be fine.
Re: (Score:2)
That just means I can't change my username, seriously if you aren't in total control of the scanning device once someone captures your face of fingerprint they have it forever.
Re:What could go wrong using the same biometrics? (Score:4, Informative)
How often do we see fingerprint cloning attacks? They are basically spy movie nonsense. Impractical for all but the most capable adversaries, and even then difficult to execute against modern sensors.
Note that this doesn't send your fingerprint to Google or anyone else. A secret is stored securely in the phone, and the fingerprint simply authorises the secure storage to perform some public key crypto with it. The secret never leaves your device either. If a website using the system gets hacked, it only affects that website as the key is different for every one.
Obviously if you are concerned then use a password as well, but those can be hit and miss due to often very poor rules on length and content. Using both is recommended.
Re:What could go wrong using the same biometrics? (Score:4, Insightful)
Fingerprint attacks are trivial to execute. A determined teenage could do it. As could a suspicious romantic partner.
Not only do you leave your fingerprints everywhere, but back in 2008 the CCC was able to capture a fingerprint from a photograph.
Let's also not forget that police don't need your permission to use your own finger to unlock your phone. That alone should make it a non-starter.
Re: (Score:1)
Fingerprint attacks are trivial to execute. A determined teenage could do it. As could a suspicious romantic partner.
Not only do you leave your fingerprints everywhere, but back in 2008 the CCC was able to capture a fingerprint from a photograph.
Let's also not forget that police don't need your permission to use your own finger to unlock your phone. That alone should make it a non-starter.
But they would need the key-pair on your device TPM chip as well? That token is what fingerprint unlocks. That combination is hardly trivial to hack.
Re: (Score:2)
But they would need the key-pair on your device TPM chip as well? That token is what fingerprint unlocks.
The police can just use your finger. Everyone else can make a fake fingerprint. It's a fun and easy 'quick craft'.
Re: (Score:1)
Re: (Score:2)
Most people aren't all that important. If someone wants access to their phone, it's usually the police, a lover, or a family member. Again, it's trivial to bypass a fingerprint lock.
As for hacking over the internet, there are many, many, other vectors. The fingerprint side doesn't enter into it at all.
Re: (Score:1)
As for hacking over the internet, there are many, many, other vectors. The fingerprint side doesn't enter into it at all.
Well that is exactly what it does when it replaces passwords and make hacking over internet that much more difficult. Password hacking over the internet is a several order of magnitude bigger security problem today than people with local access to device and person.
Re: (Score:2)
Fingerprints don't help with that problem at all.
Re: What could go wrong using the same biometrics? (Score:1)
Re: (Score:2)
I'm saying you don't understand the problem.
Re: (Score:1)
Re: (Score:2)
Fingerprints won't help with that problem.
Re:What could go wrong using the same biometrics? (Score:4, Informative)
Also please remember that police can demand your fingerprint and other biometrics, but currently do not have the right to demand your passwords.
I'm not a criminal, but in case I ever want to be one, I'd prefer not to make it easy to have my information accessed by The Man.
Re: (Score:2)
This is the first reasonable objection I have seen to the "passkey" idea. Most objections are random "Look, Ma, I'm sooooo smart!" complaints, but this one is valid.
Basically, "passkeys" seem to replace bad passwords (think of people who use the same password on all of their accounts). If you use a password manager, don't use passkeys. If you use 2FA when you are not forced to, don't use passkeys. If you know to never EVER talk to police, don't use passskeys. But for 80+% of people, a passkey will be w
Re: (Score:2)
Re: (Score:1)
Never used one... (Score:3)
How common is it with the slashdot crowd?
The article then says unlock your passkey with biometrics....no thank you.
I don't use biometrics either...so far, passwords work just find for me.
I see no reason to change.
Re: (Score:1)
Re: (Score:2)
I use a password manager (with "cloud" storage) for 95% of my passwords. It's a slight drop in security, and a major jump in reliability, usability, and share-ability (I can share certain passwords with my wife). I've decided the trade-off works for me.
A password lets you use different complex passwords for every site, including sites you access once every two years.
Re: (Score:2)
The article then says unlock your passkey with biometrics....no thank you.
You don't actually unlock directly with your biometrics. You store a key-pair on your TPM chip. Then you retrieve the token on your TPM and send that.
Hackers would need your biometric data and your keystore/TPM hardware to retrieve the token and even then as soon as you lost your device and reported it lost you can invalidate all keys that were on the hardware.
This is exactly how almost every web-api works these days.
You authenticate and generate an API-Key that then can renew itself to request a new API
Re: (Score:2)
I don't want to use any biometrics for any purpose....ever.
Re: (Score:2)
Re: (Score:2)
A popular solution was / is to have some standard way to modify a complex password you've already memorized. Whatever rule is comfortable. Something like the third and fourth characters are the same as the first and third characters in the domain and adding a special character based on the length. It keeps all of your passwords unique and still easy to remember.
Re: (Score:1)
Re: Never used one... (Score:3)
I imagine most /.ers use password managers. You should use a different password for every website or service. That way, if one site gets hacked (or you get phished), the damage is contained.
But one *good* password per site is impossible to remember. By now, I have accumulated hundreds of passwords. Add in site-specific rules for those passwords, and I cannot imagine life without a password manager.
FWIW I recommend an offline manager, such as Keepass. I don't totally trust the online managers - one malici
Re: (Score:1)
I use a local (not cloud based) password manager - It's a highly useful - I have so many passwords - I would have never remembered them otherwise. Plus it generates random ones as per user-defined policy etc.
How can I recover my passkeys when I lose them? (Score:1)
Re: (Score:2)
Same way if you forget your sufficiently-complex password and you lose the paper with all of your passwords. Security is unreliable, reliability is insecure, pick the trade-offs that work for you. Given how terrible password are, "passkeys" are likely to be an improvement; they sure cannot be worse!
Re: (Score:2)
Re: (Score:2)
Sure. If you already have a reasonably-sane password policy, or if you voluntarily use 2FA, then don't use passkeys: you are NOT the target audience. The target audience is the 80+% of humanity who re-use the same password in multiple places, will not use a password manager, and think 2FA is way to complex. The target audience is the 80+% of humanity who only have a lock code on their phone because Apple and Google force you to add one. If you ever think about security trade-offs then passkeys are proba
Re: (Score:2)
*if* you use passwords, where "you" is the average user, "you" have a high chance of having a very lousy password policy or system or whatever. Hence general best practice, aimed at all users, is to use passkeys over passwords. "Don't have sex if you don't wanna have a kid" is an airtight policy if people followed it, but they don't.
Real solutions engage with the world the way it is, not the way we wish it was - and the way we wish it was can often be boiled down to wishing humans were rational actors. They
Used to have a google account, once (Score:1)
Until it got randomly disabled. Walked away and never looked back.
Large corporations are not proper arbiters of identity.
Re: (Score:2)
Large corporations are not proper arbiters of identity.
Amen.
Security Fallacy (Score:1)
Re: (Score:2)
FIDO authenticator levels (Score:2)
First off - what happens when I lose access to all my devices?
Now the details:
Passkey uses FIDO underneath, FIDO authenticators have certification levels. [1]
Event to get "only" L1 certified, one has to shell out $6000.
The Level required is set by the party requesting authentication (in this case Google).
How could this work if I want to use/write an opensource authenticator app? Could Google deny access through it? (yes, it could, from experience: NitroKey isn't L2 certified, my country's e-govt refuses to
Re:FIDO authenticator levels (Score:4, Interesting)
I've been figuring this one out myself. Right now, I have YubiKeys, and have some offsite, so if I lose my device, my place burns down, or I have to evacuate, I have something to go on.
At least right now, Google allows TOTP keys to be used. These are a decent standard, and there are many, many apps which can use them. I use one password manager for passwords, and another for the TOTP shared secrets. At least these work, and if you choose your program carefully, can be backed up and saved off, so if your sync gets corrupted, you still can reload your TOTP stuff. The old-school six digit Google Authenticator is still a solid performer. Yes, FIDO keys are more secure, but having the app for a backup can ensure your access can be recovered.
What would be nice is to have some type of recovery standard that isn't device focused. Perhaps a Password Card [passwordcard.org] would be nice. Something that can be taken offline and filed with paperwork. Or, perhaps a device whose sole function in life is to be a recovery key. It would have an e-Ink display, get power (and no data) from a USB port, and when one typed in a challenge code, it would pop up a response code, so it wasn't time based. Something simple that could be tossed in a safe, drawer, or other secure place and forgotten about until a recovery is needed.
Something you know vs. something you have (Score:5, Insightful)
In the US, the government can compel you to provide something you have (fingerprint, passkey). But it cannot compel something you know (password).
Choose carefully
Re: (Score:3)
The question of if you can be compelled to provide "something you know" (a password for the sake of discussion) is not fully resolved.
In some cases the courts have considered the password to be like a physical key - a piece of evidence which you can be compelled to produce (with a warrant of course). I.e., just like a piece of paper that you had written the password on which unquestionably would be subject to seizure and usable as evidence with a proper warrant and search.
Sometimes the question is if the pr
Re: (Score:1)
Re: (Score:2)
Time to memorise my fingerprints I can't be compelled to provide them. Checkmate, Obamna!
Not just "No", but ... (Score:3)
then instead of a password, it asks for a fingerprint, which unlocks the passkey system
Hell no. I like my accounts locked with "something I know", that I don't have to divulge. Not a fan of all my accounts being accessible by simply supplying a fingerprint, or facial recognition, or something not otherwise (legally) protected.
Re: (Score:2)
Passwords are not necessarily "legally protected". The case law on this is unsettled and will likely remain so at least until the Supreme Court rules on it. See my comment responding to the comment prior to yours.
40 years in IT has "erased" my fingerprints (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Forty years of typing in IT, and the local police department could not take my fingerprints for IT certification for handling police data. I tried to setup a fingerprint for my phone, but it failed multiple times, just like the livescan system the local PD used. My point is, not everyone has usable fingerprints.
I had this happen way back when I had to be fingerprinted to work at NASA Langley. My fingers were roughed up from working on my car and I had to wait a week or so for them to heal/clear up so they could take good prints. It would suck now to be locked out of my accounts for that.
Re: (Score:2)
Using your fingerprint is an *option*, not a *requirement* for passkey proof. So if you can't use it, you can't use it. Use another method.
They want MORE control over us? (Score:3)
Google already knows where we go online (thanks to the dominance of the Chrome browser), where we go in the real world (thanks to the location tracking in Android, which is *very* hard to turn off completely, plus the location sharing in Chrome), everything we type (well, almost everything, thanks to gmail and swipe typing on Android), everything we see (thanks to youtube). Most people have at least one of android phone, chrome browser, gmail account or youtube.
Does anyone except Google really think it's a good idea to give Google control over our passwords too?
So, are fingerprints secure or not? (Score:3)
Google appears to be claiming that fingerprint scanning is secure and reliable, here.
However, every time they push an OS update to my Android phones, I am required to log in with a password. They won't accept a fingerprint. If you've forgotten your password, the update just bricked your phone! Cool!
Possibly, they should be looking at removing fingerprint support, rather than removing password support.
Question (Score:2)
So how do I get my "passkey system" onto an office computer? And off it, when I'm finished.
This is obviously a "something you have" technology, bringing all the same old problems: What happens when it is stolen? What happens when I get a new laptop/phone? What happens when I'm using an unsecured (public/office) device?
I'll bet the answer will be sign all your devices into the one account (and log-out to maintain 'privacy'):
Google Chrome and its automatic "save your password" means I can access the
Not passwordless... (Score:2)
Just a password you don't know, and can't enter manually ..
passkeys across Google Accounts. hacked??? (Score:2)
seriously? only a few still type passwords? (Score:2)
"Since few of us physically type in our passwords"
What seems to be happening is these people are living in a bubble with others who act like them and believe they are seeing the whole picture.
Where I live, most of us still type in our passwords. Many use password managers but many do not. I will not speculate as to precise percentages, but the number that still type in passwords is hardly just a few.
Re: (Score:2)