Google makes passkeys default across personal accounts

[Jan]

The beginning of the end for passwords — Google makes passkey logins default

Google has ramped up its rollout of passkeys by making the login credential the default option across personal Google accounts.

The Internet giant first rolled out support for passkeys in May 2023.

 

[DapperDanMan]

Disadvantages seem to be few.

Or not?

 

[Death]

I am not that clued up on passkeys. But what happens when the phone that the authenticator app is on is stolen/broken, am I suddenly locked out of all my secure accounts. How would one get back in again when a new phone is introduced? (this is a serious question, please don't flame me )

 

[DapperDanMan]

How would one get back in again when a new phone is introduced?

Article says passwords will remain as a backup option for now.

 

[backstreetboy]

I am not that clued up on passkeys. But what happens when the phone that the authenticator app is on is stolen/broken, am I suddenly locked out of all my secure accounts. How would one get back in again when a new phone is introduced? (this is a serious question, please don't flame me )

You'll have a tablet and a laptop / PC with the passkeys on as well.

 

[Danie_V]

I'm still not understanding how the passkeys (esp the private key) is synced across my devices, and what happens if I switch back to iOS again, or back to Android? I work across OSs and devices. I'm not going into passkeys to end up locked inside a single ecosystem, or be left helpless if the main device is stolen or lost. I currently have over 800 passwords, and it is not at all easy to convert everything back and forth between different passkey systems.

 

[nicroets]

You'll have a tablet and a laptop / PC with the passkeys on as well.

Most Google users don't have that. They only have a phone or two. And most Google users don't own a home. At some point in their life, they will loose their back up device due to forgetting or being evicted.

Google will still fall back into passwords, recovery email and or SMS OTPs.

So Google haven't changed much.

(The best model I've seen is Wechat where they let you're friends help you log back in. But Google isn't a social network, so they can't do that)

 

[Death]

You'll have a tablet and a laptop / PC with the passkeys on as well.

I figured the authenticator app was specific to a single device. If it's based off my google account, will the authenticator app work across multiple devices simultaneously? I usually run a single Android device and multiple Windows machines.

I got locked out of Carbonite due to a phone upgrade, and had to use some Backup codes in order to get back in, so I'm just curious.

Edit: So yea, I'm dumb. Didn't realize the authenticator app can be run on non android devices. insert <FacePalm>

 

[backstreetboy]

Most Google users don't have that. They only have a phone or two.

Google will still fall back into passwords and or SMS OTPs.

So Google haven't changed much.

The best model I've seen is Wechat where they let you're friends help you log back in.

Sure they do. Chome is installed on a billion + of them.

 

[Swa]

I am not that clued up on passkeys. But what happens when the phone that the authenticator app is on is stolen/broken, am I suddenly locked out of all my secure accounts. How would one get back in again when a new phone is introduced? (this is a serious question, please don't flame me )

You'd need a second backup making it even less secure unless it uses something that's tied to you in which case if it's stolen once it's stolen forever. Besides if it's in addition to passwords it's simply an additional point of attack. Google hasn't thought this through and it's just another way to get people locked into their ecosystem. Right now there's too many hiccups and it's not ready for the market.

Currently I can gain access to all sites from my Google account and where I use the authenticator I have both backup codes where provided and have it duplicated on the tablet.

 

[Priapus]

I figured the authenticator app was specific to a single device. If it's based off my google account, will the authenticator app work across multiple devices simultaneously? I usually run a single Android device and multiple Windows machines.

I got locked out of Carbonite due to a phone upgrade, and had to use some Backup codes in order to get back in, so I'm just curious.

Edit: So yea, I'm dumb. Didn't realize the authenticator app can be run on non android devices. insert <FacePalm>

Uhm what app?

There is no Authenticator app when using passkeys. Only 2FA needs the app.

 

[PaulGherkin]

Quick q: is the Authenticator app the "passkey" or are they referring to something like this:

 

[Priapus]

Quick q: is the Authenticator app the "passkey" or are they referring to something like this:
View attachment 1600804

No.

Watch this.

 

[Priapus]

The beginning of the end for passwords — Google makes passkey logins default

Google has ramped up its rollout of passkeys by making the login credential the default option across personal Google accounts.

The Internet giant first rolled out support for passkeys in May 2023.

I’ve switched my Google accounts to use passkeys. So much better instead of using Authenticator apps or remembering passwords or even using password managers.

Now I just open my google mail account. Enter username. Confirm with Face ID. Done.

 

[Swa]

Quick q: is the Authenticator app the "passkey" or are they referring to something like this:
View attachment 1600804

I'm guessing they install some code to your device then whenever you log in on a new device it does the same there. The actual "key" would be whatever authentication you are using on the device.

 

[Ninja'd]

Most Google users don't have that. They only have a phone or two. And most Google users don't own a home. At some point in their life, they will loose their back up device due to forgetting or being evicted.

Di- did I just get poorshamed for having an Android?

 

[Priapus]

I'm guessing they install some code to your device then whenever you log in on a new device it does the same there. The actual "key" would be whatever authentication you are using on the device.

Pretty much. The “key” is biometrics. So Face ID or fingerprint.

 

[StBlade]

Microsoft also has a keyless login system in the works. Would make my life a lot easier with users using poor passwords.

 

[Death]

Uhm what app?

There is no Authenticator app when using passkeys. Only 2FA needs the app.

Colour me even more dumb.
2FA and Passkeys are not the same thing. My brain has done me dirty today.

Just watched the YT link posted by @Priapus , makes so much sense now.

I'll see myself out...

 

[Priapus]

Colour me even more dumb.
2FA and Passkeys are not the same thing. My brain has done me dirty today.

Just watched the YT link posted by @Priapus , makes so much sense now.

I'll see myself out...

Nah don’t worry. It’s not easy to understand at first. Hence why I posted the video.