While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
> And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!
I guarantee you this is within the realm of possibility based on one single experience.
When you upgrade your phone perhaps keep your old one in a safe and charge it and login to Gmail monthly or something?
I’m also quite certain the codes could work instantly with no trouble in some circumstances. Now know it’s risky though. And I’m sure it’s a security measure based on real, deeply painful and costly instances of unauthorized access. Just don’t know what we’re exactly supposed to do…
Google gives you no guarantee of service for your account. They could arbitrarily decide to lock you out for any reason and you have literally no recourse.
elteto · · focus · HN ↗
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
mschuster91 · · focus · HN ↗
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
iso1631 · · focus · HN ↗
Click "I lost my device", enter contact, get a reset link via email/sms
terminalbraid · · focus · HN ↗
jmbwell · · focus · HN ↗
I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible
Barbing · · focus · HN ↗
Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!
hobo123 · · focus · HN ↗
Barbing · · focus · HN ↗
When you upgrade your phone perhaps keep your old one in a safe and charge it and login to Gmail monthly or something?
I’m also quite certain the codes could work instantly with no trouble in some circumstances. Now know it’s risky though. And I’m sure it’s a security measure based on real, deeply painful and costly instances of unauthorized access. Just don’t know what we’re exactly supposed to do…
terminalbraid · · focus · HN ↗