News for hackers. Stuff that matters.

A comment on Google is making their weak, flawed passkey system the default login method. Parent comment

Re:Google is making their weak, flawed passkey system the de... by mschuster91 on Tuesday October 10, 2023 @01:45PM (#37835125)
> And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?

Most apps don't, an attacker can do a lot of damage as long as they manage to keep the phone from activating screen lock.

[ Parent | on HN ]
Re:Google is making their weak, flawed passkey system the de... by izacus on Tuesday October 10, 2023 @02:34PM (#37835722)
We're talking about passkeys here, what attacker and what damage?
[ Parent | on HN ]
Re:Google is making their weak, flawed passkey system the de... by mschuster91 on Tuesday October 10, 2023 @06:10PM (#37838341)
It's literally in the first Google result for "passkey", the Google documentation itself [1]:

> Important: When you create a passkey, you opt in to a passkey-first, password-less sign-in experience. Create passkeys only on personal devices that you control. Even if you sign out of your Google Account, once you create a passkey on a device, anyone who can unlock the device can sign back into your Google Account with the passkey.

[1] https://support.google.com/accounts/answer/13548313?hl=en

[ Parent | on HN ]