Re:Google is making their weak, flawed passkey system the de...
by izacus on Tuesday October 10, 2023 @01:43PM
(#37835111)
> Some applications support requiring a login with either a dedicated PIN, password or biometrics upon each activity launch (e.g. Telegram, Signal). The only way for an attacker to breach that is to either scrape the phone for credential stuffing or to force me to unlock the app.
And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?
Re:Google is making their weak, flawed passkey system the de...
by bryanlarsen on Tuesday October 10, 2023 @02:28PM
(#37835656)
Most email apps and SMS apps don't, and those are the standard password reset and 2FA mechanisms.
Re:Google is making their weak, flawed passkey system the de...
by mschuster91 on Tuesday October 10, 2023 @01:45PM
(#37835125)
> And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?
Most apps don't, an attacker can do a lot of damage as long as they manage to keep the phone from activating screen lock.
Re:Google is making their weak, flawed passkey system the de...
by izacus on Tuesday October 10, 2023 @02:34PM
(#37835722)
We're talking about passkeys here, what attacker and what damage?
Re:Google is making their weak, flawed passkey system the de...
by mschuster91 on Tuesday October 10, 2023 @06:10PM
(#37838341)
It's literally in the first Google result for "passkey", the Google documentation itself [1]:
> Important: When you create a passkey, you opt in to a passkey-first, password-less sign-in experience. Create passkeys only on personal devices that you control. Even if you sign out of your Google Account, once you create a passkey on a device, anyone who can unlock the device can sign back into your Google Account with the passkey.
[1] https://support.google.com/accounts/answer/13548313?hl=en
Some applications support requiring a login with either a dedicated PIN, password or biometrics upon each activity launch (e.g. Telegram, Signal). The only way for an attacker to breach that is to either scrape the phone for credential stuffing or to force me to unlock the app.
Unfortunately, at least for Telegram and Signal neither support a "duress PIN", and iPhones and Android don't as well. Basically, a PIN code that when supplied to any app leads the device to lock itself down completely - force-close all applications immediately, wipe all encryption keys from RAM to prohibit a "freeze" attack, and shut down the device. Ideally it would also distribute a trigger to all other devices and services one owns that these lock themselves down as well, and only let themselves unlock after being supplied with a dedicated password.