See.. the sad thing for doomsayers like you is that if even 1% of users were affected then there would be mass exodus from Gmail. It does not.
Yes, you don't use Gmail so it does not matter. You may be don't know. And often even average Joe some how has a oldphone or iPad that has oldgmail account there or logged into wife's phone or phone based SMS whatever.
it is ok to hate passkeys or google or love only self-hosted but let others do what they want.
I have been user of solokeys (since the first one) - only opensource hardware keys. works for me...
But if you go to the local highstreet then there are tons of people doing this screenrepair etc just to recover the account. Average Joe doesnot mind paying for that. Even will give the repair guy full password to transfer all data from old to new phone.
Downvotes does not matter. People here that are privacy inclined always find ways to argue about Google or Apple (any major companies). But if you look at their private lives - they adopt tech ASAP. A majority have Apple Pay or Google Pay. Paypal. At the same time use bitwarden also. (And that is fine)
These privacy zealots fail to realise that majority of population does not have time to setup bitwarden server or lineageos or zfs storage etc.
Once you talk about privacy/security then - I am not even sure you should do it here in HN - a bastion for encouraging Silicon valley practices.
In principle, you can remove biometrics and still use passkey (by using phone password only).
If you see my text, I wrote clearly - passkeys are great convenience + security - For the majority. People don't need to waste time in searching login names.
TBH, I was in a few Free Software Foundation Europe and linux conferences in the last year - in my view - at least half of them were using - passkey with iPhone or Android (including Playservices). So people have accepted the reality.
> Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?
Lets say it is a android phone. Open amazon app. login in the usual user/password + 2FA (like with QRcode or phone). create passkey. done. This passkey would have been now synced to your google account.
Take next spouse phone. Open amazon website or app. try login it will try for passkey but cannot find it. so
- login in the usual user/password + 2FA (like with QRcode or phone). create passkey. done
- Now this passkey would have synced to spouse google account.
In future, assuming you have apple or windows laptop. assume you have signed into Google (chrome). Now go to amazon. It will ask - shall I sign in with passkey. Yes, give your macos fingerprint or windows hello or password of that laptop. login Done magically. You dont even need to remember username or password.
Assuming you both have iPhones. You can sync the passkey to icloud account. And for every new iDevice it will be available.
The main bottleneck of passkey would be that all 3rd party sites will have another non-passkey way as backup to login. I have never seen a website that would say - remove all other methods and keep only passkey.
In a way passkey is 99% convenience. If a hacker would some how get your sms and password they can by-pass.
The title is correct. But any of you changes or lessons are perfectly fine. (Sure, a bit awkward to do ssh from cafes). May be reading the Google SRE PDF (or equivalent) would have been a bit more useful. At my wife's business one of the team member shall LOGIN to DO/AWS every month send a screenshot that account/CC is in good standing.
Yes, you don't use Gmail so it does not matter. You may be don't know. And often even average Joe some how has a oldphone or iPad that has oldgmail account there or logged into wife's phone or phone based SMS whatever.
it is ok to hate passkeys or google or love only self-hosted but let others do what they want.
I have been user of solokeys (since the first one) - only opensource hardware keys. works for me...
But if you go to the local highstreet then there are tons of people doing this screenrepair etc just to recover the account. Average Joe doesnot mind paying for that. Even will give the repair guy full password to transfer all data from old to new phone.