News for hackers. Stuff that matters.
Re:Google Rolling Out Passkey Passwordless Login Support to ... by LibertyBeta on Wednesday October 12, 2022 @11:50AM (#33178763)
Interesting. I'm still struggling to see how this is better than just using a yubi/solo-key
Re:Google Rolling Out Passkey Passwordless Login Support to ... by selykg on Wednesday October 12, 2022 @11:53AM (#33178817)
I would use this in addition to those. Instead of having to buy two Yubikeys I can buy one and use a software solution as well.

Since I already use a phone capable of doing the same thing, let my phone be my main authenticator, and then I can use a Yubikey as a backup.

It's not like one is necessarily better than the other, except that you already carry a phone and they're capable of being a hardware device that works with Webauthn. No need to carry a second device or, pay for one, for that matter. Since at least with Apple's solution it'll sync over iCloud Keychain.

If you're happy with Yubikey's, nothing changes. But for the average person, this makes Webauthn an option without having to buy any hardware or carry something you are more likely to lose because you don't understand the intricate details of how the thing works. I wouldn't expect my parents to understand how a Yubikey works well enough to know it should be used as a pair, for backup purposes, but that is a barrier to entry for them that they don't need to worry about now.

Re:Google Rolling Out Passkey Passwordless Login Support to ... by LibertyBeta on Wednesday October 12, 2022 @12:34PM (#33179423)
That makes sense. I do worry we are starting to build key chains that are leveraged obliquely to the user.

Once passkey support comes to bitwarden I'll be a little more comfortable I think.

Re:Google Rolling Out Passkey Passwordless Login Support to ... by runako on Wednesday October 12, 2022 @11:52AM (#33178806)
Passkey will be supported, with no new user behavior, by ~a billion devices currently in use. It is better because a billion+ devices already have support for this.
Re:Google Rolling Out Passkey Passwordless Login Support to ... by sowbug on Wednesday October 12, 2022 @12:01PM (#33178952)
"To address the common case of device loss or upgrade, a key feature enabled by passkeys is that the same private key can exist on multiple devices. This happens through platform-provided synchronization and backup."

Thus, unlike a FIDO2 key, you don't have to visit every online service to tell it about the new redundant keys you add.

The rest of the security article linked by madjam002 goes into detail how Google implements their version of that backup. It's a bit like Keybase in the sense that your other devices act as keys to unlock the backup for new devices.

Re:Google Rolling Out Passkey Passwordless Login Support to ... by mpalmer on Wednesday October 12, 2022 @11:56AM (#33178878)
This is public-key-crypto-based authentication for the average user who will almost certainly never buy a security key but who probably owns a device that offers secure identity verification (laptop, phone).

Yubikeys are great but they're super niche. Among Android users alone there might be a billion people who will never buy one.

Re:Google Rolling Out Passkey Passwordless Login Support to ... by eli on Wednesday October 12, 2022 @11:51AM (#33178778)
More people own an Android phone than a yubikey?
Re:Google Rolling Out Passkey Passwordless Login Support to ... by aseipp on Wednesday October 12, 2022 @12:21PM (#33179240)
At the very minimum, one undeniable technical advantage Passkeys have -- that they share with their foundation, WebAuthn -- is that Passkeys are unphishable.
Re:Google Rolling Out Passkey Passwordless Login Support to ... by potatoz2 on Wednesday October 12, 2022 @08:28PM (#33185652)
That’s not a technical advantage over Yubikeys/SoloKeys, since they also use WebAuthn and are also unphishable.
Re:Google Rolling Out Passkey Passwordless Login Support to ... by postalrat on Wednesday October 12, 2022 @08:33PM (#33185696)
Don't all fido2 yubikeys support webauthn? They have the advantage that they can't be cloned/sync/etc. Might be an inconvenience for some but for me that's an advantage.
Re:Google Rolling Out Passkey Passwordless Login Support to ... by jrm4 on Wednesday October 12, 2022 @11:52AM (#33178803)
More convenient, but less safe for everyone in the long run.