Hacker News Reader

Hacker News

Comment by handsclean | Hacker News Reader

Parent Full thread

handsclean

So, if I understand correctly:

1. Google can lock you out, but it’s ok because 1% of users have a workaround,

2. You will lose access, but it’s ok because you won’t if you didn’t use this product,

3. Google can log in as you, but it’s ok because we should trust them not to, and

4. We’ve got no recourse, but it’s ok because we were probably helpless anyway?

Companies may get away with this for other products, but the bar is way higher for security products. There are real solutions, or at least ameliorations, and it’d be unsafe to use the product without ensuring they’re there.

View on HN

Sorry, but I don't think you do understand correctly, and I mean that in an honest and non-judgemental way, I think you may have misunderstood what Passkeys are, and what this announcement is.

With this announcement, you can log into a Google account with a Passkey. That Passkey could be generated by anything implementing the spec – an iPhone, a browser, a home-grown Python script, whatever you want.

Google can still lock you out of your Google account whether you use a Passkey or not. If you use your Google account to sign in to other sites, Google can also therefore still prevent you from logging into those other sites, as they have been able to do before (I don't know if they do this as a matter of policy, but they theoretically can).

Passkeys do not change this.

The only potential place that Passkeys might change things is if you use a Passkey generated by a Google technology, like Android or Chrome. You could use those Passkeys for logging into anything, not just Google accounts. As these are tied to a device, I don't believe the Google account on that device affects them in any way. Google can't lock you out of your Android phone, and can't prevent you using Chrome, so can't prevent you using Passkeys in either of those systems.

I am no fan of google, but this is such a grotesque distortion that it feels like you are just pushing an agenda here.

1. They can lock you out of your google account and services you authenticate using login with google, but no more or less than they can lock you out without passkey authentication.

2. You may lose access as per #1, but no differently than if you lost access to your google account having used MFA or whatever other method to log in. It's completely orthogonal.

3. This is just wrong. The passkey is a cert which is used to sign something and send them the signature they can verify with the public part of the cert. They can't login as you. If you don't trust them not to backdoor the passkey itself during generation you can use a passkey generated by someone else.

4. You never had any recourse. This doesn't change that at all either way. It's a login methodology.

Reply on news.ycombinator.com