Hacker News Reader

Comment by jackson1442 | Hacker News Reader

What are the odds that someone with a passcode 1234 is 1/ already signed into Google on their phone or 2/ has their Google password already saved in the device password manager (since it asks you to save it every time you sign in) which is also protected by the device pin?

At least in this case the thief has to steal the physical phone instead of guessing "password123" on the google signin prompt from the comfort of their home.

Also- how many non-techy people do you know that avoid using on-device biometrics? On my end, the number is approximately 0.

View on HN

> What are the odds that someone with a passcode 1234 is 1/ already signed into Google on their phone

...very high? I don't understand how this is unlikely, pretty much every phone owner with a google account is signed into that account on their phone.

The point is that the odds are very high, i.e. if you've stolen their phone and know the PIN, you're very likely already in their account, passkey or no passkey.

Exactly. So they already have access to your email, passwords, and text messages regardless of the passkey

Don’t try to argue that on-device biometrics are a foolproof solution to this. Even at it’s best you can unlock a device from a sleeping (or drunk or naive) user which just brings us back to the same issue: already being logged in to a passkey service.

From the parent I responded to, emphasis mine:

> The criticism is based on the idea that most non-techie folks are unlikely to use a strong PIN _and are unlikely to set up strong biometrics._

On-device biometrics are typically _also_ used to unlock the device password manager, so my other remarks still apply. I bet a sizeable portion of the HN crowd also uses biometrics to unlock their well-configured password managers on their phone.

At least, that's what I personally do. Entering my very strong vault password every [lock duration] on a touch keyboard is already irritating enough; I'd rather just look at my phone to unlock my passwords when I need to use autofill.

Reply on news.ycombinator.com