Google Announces Support for Account Passkeys

[citivolus]

No parts of iOS can work only with biometrics, because what they do is wrap other key material while the device is on, subject to various purge policies (such as with too many failed attempts, in some cases). In order to work again after that, the key material (such as the device passcode) needs to be entered.

I don’t know what to say… this is exactly how I have the Bitwarden app configured today. The passwords in the Bitwarden vault can only be accessed via Face ID. When there are too many failed attempts, it prompts for the Bitwarden Master password. The iPhone passcode cannot be used to access the vault, ever. This is precisely why I have switched to storing banking and other critical passwords in Bitwarden as opposed to iCloud Keychain.

 

[sniffies]

Doesn't seem to work for me, created the Passkey, can see it in the Google account and in the Apple Keychain but when you sign in to Google you just get the usual username/password box. On my iPad after signing in I'm asked to setup a Passkey, if I say yes it says one's already created!

Where in the Apple Keychain is it? I've created a passkey on my Mac, but when I go to Apple Passwords and search for 'passkey,' nothing is found.

 

[soulsteelgray]

Doesn't seem to work for me, created the Passkey, can see it in the Google account and in the Apple Keychain but when you sign in to Google you just get the usual username/password box. On my iPad after signing in I'm asked to setup a Passkey, if I say yes it says one's already created!

Have you tried enabling the setting for "Skip password when possible"? (Disclaimer: unsure if this link will take you directly to that option.)

Sign in - Google Accounts

myaccount.google.com

Where in the Apple Keychain is it? I've created a passkey on my Mac, but when I go to Apple Passwords and search for 'passkey,' nothing is found.

Is it stored under the entry for Google?

 

[QuarterSwede]

Where in the Apple Keychain is it? I've created a passkey on my Mac, but when I go to Apple Passwords and search for 'passkey,' nothing is found.

It’s in your original Google entry above your password entry.

 

[QuarterSwede]

What happens with my iCloud stored passkeys if I decided to switch to Android at some point? Meaning how could I log in to sites that the Android device didn’t have stored.

You can create more than one passkey for the same account. You can also revoke passkeys.

 

[_Spinn_]

This is great. Now I just need Bitwarden to support storing Passkeys.

 

[gaanee]

So with Passkeys, you always need to have access to your verified phone/device to scan the QR code and log in.
What do you do when you don't have access to that device like on travel or it's broken?

 

[svish]

Good to see Passkeys rolling out.

 

[bkaus]

Does this work with google app domain (or whatever they call it now)?

 

[sherloque]

Doesn't seem to work for me, created the Passkey, can see it in the Google account and in the Apple Keychain but when you sign in to Google you just get the usual username/password box. On my iPad after signing in I'm asked to setup a Passkey, if I say yes it says one's already created!

I had the same issue when I created the passkey on my Mac. I deleted that passkey (both in the keychain and in my google account) and started over with a passkey created on my iPhone. That new passkey works on my Mac, iPad, and iPhone.

 

[bkaus]

What other sites support passkeys? All I find is a Dec 2022 list... probably hasn't changed much.

 

[mystery hill]

Does this work with google app domain (or whatever they call it now)?

It’s not yet available for Google Workspace accounts.

 

[dwaite]

It may be more convenient, but is Face ID access really more secure than a password+2FA? It’s easy to think of scenarios that defeat fingerprint or Face ID.

Yes, they also have to take your phone. Things like SMS are vulnerable to number porting hacks, and are still vulnerable to active phishing attacks.

The big difference is that passkeys are way, way harder to phish, and if some site gets the password database dump it doesn't buy the attackers anything useful - not only can they not bridge that to try to log into other websites, it won't even let them log into the same site.

 

[dwaite]

Right? Why are so few websites supporting this stuff. Everyone should be all over this by now....

It's still new, and larger sites have a lot of investment in a certain way of doing things. In some cases they feel passkeys can only replace the password, not their other steps in authentication - so it isn't worth them supporting yet.

 

[dwaite]

So will this work with something like 1Password too?

1Password has announced they plan to support this. Android has a beta system to let you enable potentially multiple systems for storing passkeys. On iOS the should feasibly be able to support it using a Web Extension until Apple hypothetically announces something

 

[dwaite]

That was just an example off the top of my head. But even if they get your info, passwords are still a goldmine, because a lot of people use the same password on multiple site. So an attacker with your email and password may try it on other popular sites, and there's a high chance it'll work (for a larger percentage of audience).

You have to wonder what percentage of people use their corporate email and corporate password on LinkedIn.

 

[dwaite]

Which specific key to buy for using passkey?

Apple platforms, Android, and Windows Hello are all usable here with their built-in support. Something like a Yubikey or other FIDO-certified security key should work as well (although not under Safari)

 

[dwaite]

WHat if your iPhone is lost or stolen. How do you recover all that?

How do you do it with passwords today?

 

[dwaite]

The danger of using iCloud to store your passwords and passkeys due to Apple's security design flaw they refuse to fix. Best to use a 3rd party password manager.

What security design flaw in iCloud is that?

 

[macintologist]

How do you do it with passwords today?

I type in my Apple ID password and recover everything! Because I have my Apple ID password memorized!

 

[sk1ski1]

What security design flaw in iCloud is that?

These recent Wall Street Journal videos explains Apple security flaw well -

 

[4nNtt]

I don’t know what to say… this is exactly how I have the Bitwarden app configured today. The passwords in the Bitwarden vault can only be accessed via Face ID. When there are too many failed attempts, it prompts for the Bitwarden Master password. The iPhone passcode cannot be used to access the vault, ever. This is precisely why I have switched to storing banking and other critical passwords in Bitwarden as opposed to iCloud Keychain.

The original poster is correct. Face ID will still require a passcode after 48 hours or after the iPhone restarts. The poster was not saying it would fall back to a passcode.

I think you are confusing the way biometric security works on iOS with the way Bitwarden works which is a layer on top of Apple’s biometric security.

 

[4nNtt]

The danger of using iCloud to store your passwords and passkeys due to Apple's security design flaw they refuse to fix. Best to use a 3rd party password manager.

There is no security design flaw. Third party password managers can still make sense for better cross-platform support or for enterprise/business features.

LastPass on the other hand had been hacked many times due to poor security practices within their company.

 

[sk1ski1]

There is no security design flaw. Third party password managers can still make sense for better cross-platform support or for enterprise/business features.

Yes, it's a security design flaw that Apple allows Keychain access by the phone's passcode. The Keychain should be better protected. It should have the option to be protected by a user defined password or biometrics. Apple's own Notes App has better protection than the Keychain. It allows notes to be locked by a user defined password.

 

[Will Co]

It's still new, and larger sites have a lot of investment in a certain way of doing things. In some cases they feel passkeys can only replace the password, not their other steps in authentication - so it isn't worth them supporting yet.

Yes - I accept that. But also, if that's the case, it will not necessarily be an impediment to adoption. I suppose the question I'm asking is at what level does a technical barrier become a genuine blocker, or remain just an excuse. A groundswell of support is needed on this, to make it really happen.