News for hackers. Stuff that matters.

A comment on Google is making their weak, flawed passkey system the default login method. Parent comment

Re:Google is making their weak, flawed passkey system the de... by izacus on Tuesday October 10, 2023 @01:43PM (#37835111)
> Some applications support requiring a login with either a dedicated PIN, password or biometrics upon each activity launch (e.g. Telegram, Signal). The only way for an attacker to breach that is to either scrape the phone for credential stuffing or to force me to unlock the app.

And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?

[ Parent | on HN ]
Re:Google is making their weak, flawed passkey system the de... by bryanlarsen on Tuesday October 10, 2023 @02:28PM (#37835656)
Most email apps and SMS apps don't, and those are the standard password reset and 2FA mechanisms.
[ Parent | on HN ]
Re:Google is making their weak, flawed passkey system the de... by mschuster91 on Tuesday October 10, 2023 @01:45PM (#37835125)
> And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?

Most apps don't, an attacker can do a lot of damage as long as they manage to keep the phone from activating screen lock.

[ Parent | on HN ]
Re:Google is making their weak, flawed passkey system the de... by izacus on Tuesday October 10, 2023 @02:34PM (#37835722)
We're talking about passkeys here, what attacker and what damage?
[ Parent | on HN ]
Re:Google is making their weak, flawed passkey system the de... by mschuster91 on Tuesday October 10, 2023 @06:10PM (#37838341)
It's literally in the first Google result for "passkey", the Google documentation itself [1]:

> Important: When you create a passkey, you opt in to a passkey-first, password-less sign-in experience. Create passkeys only on personal devices that you control. Even if you sign out of your Google Account, once you create a passkey on a device, anyone who can unlock the device can sign back into your Google Account with the passkey.

[1] https://support.google.com/accounts/answer/13548313?hl=en

[ Parent | on HN ]