Hacker News Reader

Comment by scarmig | Hacker News Reader

Encouraging worse security practices (dumping SSO for password logins) for an ideological goal that helps no one's privacy.

View on HN

Passkeys becoming prevalent makes dropping BigTech SSO for personal use more palatable.

Google will still store and sync the keys for users of Android and Chrome, but their code won’t run on sites who opt out of Login with Google. It’s an evolution of the security model. This is arguably superior considering the ability to migrate passkeys elsewhere. You have improved sovereignty over your auth story (versus “haha google locked you out of everything and you have no recourse”).

TLDR PKI > consumer federated identity

I use a hardware security token to log into my Google account and then use that to log in to several other services. If I were to lose my token, I would still have my backup tokens, and could update this account to use a new token and unenroll the old token.

If instead, every site I had ever logged into kept track of my tokens I would need to visit each of them and do the same thing.

(It's already messier than that because some accounts I have--GitHub and Facebook--don't accept SSO but are important enough to be worth protecting with hardware tokens. But I don't want to go farther in this direction!)

We’re not talking a loss of a hardware authenticator, we’re talking the loss of access to your Google account. Worst case with passkeys is you lose access to the cloud corpus of your keys due to loss of account access while still having them on your device (and/or a passkey manager).

I think I'm much much more likely to lose a hardware authenticator than my Google account

And that's not necessarily universally true.

* Securing hardware authenticators is much more within our control than the whims of Google are.

* Most of us aren't ex-Googlers with contacts and reach (which are the only way to get reliable support when one's account does get borked), so that side of the risk is also much higher for normal people than for you.

https://hn.algolia.com/?q=google+account+locked+out

https://news.ycombinator.com/item?id=30771057

And that’s just HN participants, not the unknown layman cohort.

I read through the links, and there were about 15 posts where people got locked out of their Google account over a 12-year period. Many of these are links to articles on other sites not written by the submitter, but we'll count them anyway. So that's ~1 per year.

According to dang, there are ~100k monthly active logged-in HN users [1]. In a population that size of 25-54 year-old Americans, you'd expect around 290 to die each year [2].

Getting locked out of my Google account is pretty low on my list of things to worry about.

[1] https://news.ycombinator.com/item?id=9219581 (and that was in 2015 - I assume it's grown since then)

[2] https://www.cdc.gov/nchs/products/databriefs/db427.htm

On the other hand, if the yearly amount is so small, a service (a single dedicated human) to fix/reset/correct those issues should be affordable by Google.

This is not specific about Google, a lot of services/apps/whatever like (and it is probably true) to state how they are in practice error-free, at least with account management, yet when this extremely rare event happens there are no (or extremely complex) ways to fix the problem, short of posting to HN or to a social and hope that some good soul working at that company notices the issue and decides to solve it.

If you look through those they are almost all about people forgetting their password or losing whatever they are using for 2FA: that is exactly what I'm worried about!

In my particular case, I am happy with my 2FA setup for Google (three security keys, across multiple locations) so I think that category of lockout is pretty unlikely.

And I've already lost my keys once in my life, about 20 years ago.

How do you think that compares to "lost my keys" or "lost my wallet"?

https://news.ycombinator.com/item?id=33963269

What I'm advocating for above is that people get multiple hardware tokens, and keep them in separate safe places. What Doreen is running into is that if you use your phone as your only second factor you have a problem if your phone stops working. I don't see how these are in tension?

I think our expectations are simply out of alignment. What you're advocating for is unreasonable if a loss of hardware tokens means a permanent loss of account access with no recourse, and I don't think that's a hard case to make to legislators and regulators.

I didn't say anywhere that loss of a hardware token should mean "permanent loss of account access with no recourse"?

What resource can Doreen go to at Google to get access to their accounts if Google’s security algorithm is requiring access to devices or authenticators they no longer have? I’m trying to be reasonable, but all I see is a tech company who enforces strong security practices with no exception handling. Great for Google and keeping costs down from an infosec and customer service perspective, but highly detrimental to those who lose what is very valuable to them (their emails and digital identity), and humans will lose valuable items (including devices, authenticators, and recovery codes) all the time.

I don’t expect for us to solve this here, and I’m sure my perspective will differ substantially from those affiliated with Google or tech professionals in general (who don’t fully internalize the layman’s experience). I do believe I’ve provided sufficient evidence this is a real problem, and it’s likely going to require federal statute or FTC guidance to require tech companies to recalibrate their customer service and infosec ops around access and identity.

Regardless, I appreciate the discourse on this topic.

I don't understand why you're arguing this with me? It doesn't seem to relate to anything I've said above

For passkeys, I think allowing users to migrate their credentials wherever they want is key. I know Google/Apple/etc are working on a potential solution for that, but I think third-party solutions would be best from an "incentive alignment" perspective (Google and Apple don't want you moving away from their ecosystem).

As an aside, I would like to plug my own passkey solution, Bulwark Passkey (https://bulwark.id) which is open source and allows credential exports. Whatever passkey solutions people end up using, managing credentials is going to be the key challenge (pun intended).

> Encouraging worse security practices (dumping SSO for password logins) for an ideological goal that helps no one's privacy.

It hardly seems reasonable or rational to attack the mere thought of handing out all auth responsibilities to a shady monopoly with a track record of dubious practices and government tie-ins for being "an ideological goal that helps no one's privacy".

The pervasiveness of any Google code running on webpages across the net has been a danger to everyone's privacy. I think this is a worthwhile tradeoff though I'm sure many like you will disagree.

I don't see why the page would be the one deciding that tradeoff for user. As long as you can pick plain old user/password there is no ham offering other options

* There is nothing wrong with password logins if they are used properly.

* Google does not have a good track record of customer service, not putting all your eggs in their unreliable basket seems like a good idea from a security point of view.

* The privacy argument is a bit of a hot take in this case, and is probably not as valid as a reason to dump Google SSO as eggs-in-unreliable-basket argument.

password logins are better security than phone verification in many cases.

Password logins are 1-factor, while password logins that use phone verification are 2-factor. In what cases does the security from 1-factor exceed the security from 2-factors?

Phone verification is 1-factor in most implementations on every popular website. It's just that the factor is now your phone, and your password can be changed with your phone number. Your password might as well not exist. The problem with phone verification is that phones are less secure than passwords. This isn't even a 1 factor vs 2 factor discussion. Again, Phone verification is 1 factor.

To be more specific, if the implementation of 2 factors requires both factors, then it is indeed more secure. If it's a form of 2 factor that requires only one factor, it's less secure, because now you have more attack surface.

> In what cases does the security from 1-factor exceed the security from 2-factors?

1. If you consider the loss of a phone number to be a more likely event than a forgotten password (non-obvious example - if you have no extra money to keep the phone number working).

2. If some powerful contractors can capture the data coming to your phone.

3. Also, if there is some kind of banhammer (Google is famous for banning for no reason) in the "2-factor" and no banhammer in the 1-factor (Bitcoin has no third-parties who might steal or freeze your funds), then your chance of encountering a banhammer in your face is infinitely greater in the first case.

More than 1 factor creates more problems than usefullness tbh if you are enough responsible for never lose your credentials.

> 1. If you consider the loss of a phone number to be a more likely event than a forgotten password (non-obvious example - if you have no extra money to keep the phone number working).

That's silly. If you lost your phone number, why would you attempt to log into a service and have it text or call your lost phone number? The provider in question here (along with many others), Google, provides backup codes for this situation. Besides, if you are more likely to constantly lose phone numbers, it's best not to use those for authentication/authorization.

> 2. If some powerful contractors can capture the data coming to your phone.

That doesn't matter to 2-factor. That "powerful contractor" would be in possession of a time-bound pin that can only be used by the device and account that had just had the credentials entered. It is useless to anyone else.

> 3. Also, if there is some kind of banhammer (Google is famous for banning for no reason) in the "2-factor" and no banhammer in the 1-factor (Bitcoin has no third-parties who might steal or freeze your funds), then your chance of encountering a banhammer in your face is infinitely greater in the first case.

This also doesn't apply. Google provides backup codes that can be used in such a case. As do digital ocean and others...

> More than 1 factor creates more problems than usefullness tbh if you are enough responsible for never lose your credentials.

Except that isn't true. I noticed that you placed 2-factor in quotes, showing that you likely do not understand 2-factor is formed from any two out of the three possible security factors. There is also 1.5 factor authentication, which is acceptable to put in quotes, since it is pseudo-2factor.

What you know. What you have. What you are.

> (Bitcoin has no third-parties who might steal or freeze your funds)

I'm not sure your comment was serious... Bitcoin and the entire crypto ecosystem are full of third-parties who steal or freeze funds.

Reply on news.ycombinator.com