Hacker News Reader

Comment by diego_sandoval | Hacker News Reader

> [Customers] appreciate that [SMS reset is] more convenient than resets via email.

Anecdotally, I'm annoyed every time I have to log into a Google account using phone verification, because I have to stand up from my desk and find my phone (which sometimes is in a different room) in order to receive the call/message with the code.

TOTP is much more convenient in comparison. I don't have to stand up from my desk, because I store the codes in KeePassXC.

View on HN

You can click the "try another way" link, which will allow you to use a TOTP code (which they call the "Get a verification code from the Google Authenticator app" option even if you've never used Authenticator).

I don’t have experience with TOTP on this, but I’ve seen that the “try another way” doesn’t even work with a recovery email address and a code sent to it. Google seems to make it almost impossible to login if you move away from your “home” location, unless perhaps you use its apps and are already logged in.

In the Apple ecosystem, the SMS syncs to your Mac, Safari detects the code and autofills it in the web page, and then it auto-deletes the SMS when you're done for you. It couldn't be more seamless.

Which, ironically, requires you to forever "opt-in" to 2FA on your Apple ID.

Create a passkey on each of your devices.

https://www.google.com/account/about/passkeys/

https://blog.google/technology/safety-security/passkeys-defa...

Sites that support Passkeys: https://passkeys.directory/

A lot of companies still mess up passkeys, Allowing them only as a 1:1, using one terminates the session of another, or in some cases invalidates the previous passkey entirely.

Its implementations specific I'm sure, hwoever its not as straight forward as one would hope.

Also a favorite: "Your browser does not support Passkeys".

It sure does, which these horrible sites could easily verify by invoking the single line of JavaScript [1] to learn as much, instead of assuming "Firefox -> must be unsupported". Absolutely infuriating.

[1] https://gist.github.com/miguelmota/ad833d2e6f024a7189f803664...

Hard pass. What if I lose all my devices? (Except a fireproof offsite box with a piece of paper containing most of my passwords in it.)

More realistically, what if Google decides to disable my account, and holds my passkey database hostage (which they can, by design)?

Note I said “each of your devices.” Even if Google locks you out, they are all still on at least one of your devices (if not more).

My passkeys are shared with family members in iCloud (where they are synced to) for bus factor. I don’t recommend using Google for any consumer services if you can avoid it, especially syncing your password/passkey database, as there is zero support if something goes wrong.

There are stories of Apple locking users out of their iCloud accounts.

Can you provide source? I've never seen Apple locking someone out of their account à la Google, only rare dumb user errors in the system clearly designed to effectively prevent them.

Sure, here's a first search result for the query 'locked out of Apple account': https://www.businessinsider.com/apple-not-helpful-woman-lock...

This is theft. And it was possible because the thief had her password (by spying on her.) It is known that thiefs do this, changing the password and account details very quickly to lock someone out of their account. Apple recently introduced protections against this, called Stolen Device Protection, which users can enable in Settings.

And all of your passkeys should still be on each device in such a case. It’s sync, not a singular vault.

If you still have access to them, yes. Problem is if you don't. And we need to be mindful that it's easy for us to say these things being very digitally native, while there's a huge part of the population that isn't so digitally aware and relies on companies like Apple to "make everything work".

I don’t disagree. It’s why the FTC and other federal regulatory agencies should require some sort of identity bootstrap process if you lose all of your digital identity credentials.

I’ve submitted comments to this effect to the FTC, and I’d encourage others to as well. Email (where all roads currently lead) should not be your identity in the 21st century, and losing a device or Big Tech account shouldn’t permanently banish you from digital account access.

Some relevant comments I've written on the topic in this thread: https://news.ycombinator.com/item?id=38691082 | https://news.ycombinator.com/item?id=38691156

Extra security is welcome, but I'm simultaneously terrified that I'll somehow get locked out of my Apple ID or main Gmail account.

Everything I read about Passkeys says this scenario is 100% impossible, as it's based on biometrics and no longer using a text string that can get lost, but I'm still nervous AF. I've had to do the "reset a password that's behind 2FA" dance before and it makes me want to crawl in a hole and die - super duper scary.

Somebody tell me to chill out.

Reply on news.ycombinator.com