skarra

6 ms·

1.
by skarra 2y ago
Oh no! Now I will definitely let you have the last word.
2.
by skarra 2y ago
Even Sisyphus wouldn't attempt to convince a HN crowd that not everything in the world is a big tech conspiracy...
3.
by skarra 2y ago
Oh no!
4.
by skarra 2y ago
I said "more interop" is coming.. There is a significant amount of interop that already exists, that folks are looking past or just already taken for granted (which is actually fine too!). While on a Windows machine using Edge, yo
5.
by skarra 2y ago
Thanks for your faith. I work on the team shipping passkeys at Google. We are very much hard at work to realize the full potential of passkeys. Platform lockin serves no one. That is no one's intent - independent password managers stor
6.
by skarra 3y ago
You can read more about the security properties of passkeys on your Google account on this post from earlier this year when support was originally announced: https://security.googleblog.com/2023/05/so-long-passwor
7.
by skarra 3y ago
On account recovery, the user is strictly no worse off with passkeys relative to passwords and arguably actually better off in many cases. This is not what I'd call deliberately ignoring concerns.
8.
by skarra 3y ago
Your concern around attestation (mis)use is spot on. I'd say the industry is yet to arrive at an acceptable consensus or compromise on that question.
9.
by skarra 3y ago
I work on Google's authentication team. I have mentioned this elsewhere in the thread.
10.
by skarra 3y ago
Did you know that Apple allows sharing passkeys via Airdrop?
11.
by skarra 3y ago
It is a fair observation. And I can see why users tend to be alarmed about this. Although in my experience users tend to significantly underestimate the real risks of online attacks relative to these more visceral threats. Let met ask you:
12.
by skarra 3y ago
Passkeys represent the cumulative wisdom and experience (and compromises!) of the whole industry on how to keep users safe online. Appreciate your opinions that these efforts are doomed. It is safe to say, "We'll surely find out!&
13.
by skarra 3y ago
Password managers like Dashlane and 1Password have announced support for storing and synching passkeys. As passkeys becomes more popular I expect more providers to step up as well. Ecosystem lockin is not how we make a new technology like t
14.
by skarra 3y ago
If you are on Apple ecosystem, iCloud can sync. Other password managers like 1Password can also be used to store your passkeys. If none of the above, you can always set up a physical security key and leave it at home. IMO if you're rea
15.
by skarra 3y ago
You're spot on. And I work on the Google authentication team right now :)
16.
by skarra 3y ago
Think of it as using iCloud as your password manager and storing your OTPs - someone breaks into your iCloud, they get access to all the passwords and OTPs to login to any service in iCloud. Always take the security of your password manager
17.
by skarra 3y ago
You can try this: https://support.google.com/accounts/answer/13548313?hl=en , this help center page is linked to from various parts of the product experience for regular users to get a better idea about passkeys if
18.
by skarra 3y ago
Passkeys are a new technology and everyone - including users, service providers, and organizations - will take time to learn and adapt. In this interim period the recommended approach is to provide passkeys as an alternative to whatever is