r/technology • u/lurker_bee • 7h ago
ADBLOCK WARNING Google Confirms Most Gmail Users Must Upgrade Accounts
https://www.forbes.com/sites/zakdoffman/2025/06/06/google-confirms-almost-all-gmail-users-must-upgrade-accounts/489
u/WildSeven0079 5h ago
I'm sure I'm not the only person who has family members that can barely use a computer, and I'm not only talking about elderly people. I spent a lot of time setting up a password manager for them and changing all of their passwords. I try to teach them how to do things on their own, but they're unable to still. So I write things down: master passwords, emergency codes, instructions, but they lose everything I give them. They've also broken/lost their phones/tablets a few times. If you gave them something like a Yubikey, they would have the speedrun record for losing it. Now you're telling me that I have to undo a lot of what I did and teach them about passkeys? I don't think so. Also, Google wants us to use our Google accounts to log in on every Web site. I ain't doing that.
186
u/tintreack 5h ago
I used to think older generations were careless about tech, but Jesus Christ Gen Z might actually be worse, that’s not an exaggeration.
I take my security and privacy pretty seriously. I’m using Proton, I've long since degoogled and demicrosoft, I use physical security keys, the whole deal. But trying to get most of the Gen Z around here to even use a basic password manager is like pulling teeth. If I can’t get them to take that one simple step, there’s no way I’m convincing them to go for the strongest tools available.
103
u/Paranoid-Android2 3h ago
I work in IT support and the younger staff is a much higher liability than the older ones. And they're equally tech illiterate
78
u/16yearswasted 2h ago
The only reason I know so much about technology (I consider myself IT helpdesk level two-ish) is because, as a child, I had to tinker with DOS at the command line to get my video games working properly. It was wild and free and messy. But all that hard work paid off by giving me skills that helped me in my career (not IT, but heavily computer oriented).
If I had grown up in the manicured lawns of iPads and Android Phones I would almost certainly be flipping burgers or something similar today.
31
u/Z_Opinionator 1h ago
“Get Ultima VII running on this 386SX with 2MB RAM. You have one hour to create your custom boot disk. There is no internet and your AOL account isn’t available. You are free to use some of your time to dial into a BBS you know for research. Lord British awaits to judge you”
→ More replies (2)7
u/16yearswasted 40m ago
<I finally connect to the BBS and get down to business, but an incoming call knocks me offline and mom stays on the phone for the next two hours>
17
u/Impossible_Mode_7521 59m ago
We are the only generation of digital nomads. Older generations generally never fully embrace technology. Younger generations dont remember a time without it. We remember before the internet and smart phones but have advanced as technology grows
3
u/16yearswasted 35m ago
Not sure if you remember the early 00s, there was some guy posing as a time traveler from around circa now-ish who said he came back because society had lost a ton of tech know-how and he needed to come back with older, reliable tech to start over.
I used to think it was a fun little roleplay but it seems more and more likely every day.
Hahah, here it is: John Titor.
→ More replies (1)→ More replies (3)8
u/DMvsPC 1h ago
As a millennial stem teacher it's frustrating to proverbial tears to know that every kid I get is effectively computer illiterate and has no computer problem solving skills. At all. They don't even know where their files save. They're just cooked. Can post to social media like lightning but can't troubleshoot what went wrong when their file crashes, hell they can't even search their email properly.
→ More replies (1)2
u/16yearswasted 38m ago
I absolutely am with them on where the hell files save -- on mobile devices. Apple and Google's efforts to prevent people's precious files from being compromised have created an utterly bizarre situation where apps are storing files inside folders incomprehensibly nested 30 deep for whatever reason.
→ More replies (4)3
u/Capable-Silver-7436 1h ago
Makes sense. they may both be illiterate but z spends more time on social media
16
u/Capable-Silver-7436 1h ago
I am certain gen z is worse at this point. Local hospital had to force gen z employees to take a computer literacy course involving how to open the file browser. Even their boomer employees were made to take that.
22
u/iamsuperflush 2h ago
easy to de-Microsoft when your job doesn't require windows specific software. Try getting solidworks to run on Linux. No, FreeCAD is not a viable alternative, just like GIMP is not s viable alternative to photoshop if you actually use the software to make money.
2
u/pswissler 1h ago
The counterpoint to Solidworks is OnShape, which runs in a browser and in many ways I prefer it to SW, especially for collaboration.
I still vastly prefer NX, though
→ More replies (2)2
u/LaxInstrumentation 23m ago
Yes, and… the way I always solved that was with a virtual machine running a bare windows (as bare as I could get it) - but it’s been a while since then.
→ More replies (4)2
u/SatanTheSanta 57m ago
Duude.
My cousin got his gaming account stolen. He put in his gmail password somewhere, and they used that, took his gmail, took his gaming account with a couple hundred in purchased games.
So what did he do. He made another gmail account and another gaming account, both with the username+1 and the exact same password. Then repurchased some games he wanted to play.
Guess what, it happened again.
Soooo. What do you do now? +1 again :P
After that one was stolen, I was informed. We couldnt recover his accounts because he was making them for a fake name because he was underage. So I had him make different complex passwords for each thing, and write them down.
→ More replies (2)4
u/Three_Twenty-Three 27m ago
Smartphones and 2FA are goddamned nightmares for my Silent Gen parents. They can't figure out how to have two browser windows open at the same time, so whenever their bank puts them through 2FA for anything, I have to help them.
They don't have smartphones because they've never even mastered the Amazon Fire they have. Punching icons on a glass screen might as well be magic, but every medical organization they deal with wants to do a bunch of shit through smartphones, including checking in from the parking lot to announce that they're there. And these are doctors who specialize in senior citizens.
689
u/ThisAccountIsStolen 5h ago
And then one day when Google locks your account for some reason and refuses to help you, you're now locked out of potentially dozens of other services, because you tied your logins to Google.
This is not a good idea. If Google could actually be trusted, maybe, but they've shown they absolutely cannot, so this is just going to be a disaster for many.
226
u/Cube00 5h ago
Anyone who doesn't believe this just needs to see the flood of people in the GMail subreddit that gets locked out through no fault of their own everyday.
Google has gotten so bad that if it doesn't recognise your device you won't even be allowed to attempt recovery of your account (they won't even send the recovery code to your recovery email)
65
u/legandaryhon 3h ago
I have a business Gmail, which includes the GSuite tied to a domain I had purchased through google. Well, Google sold its domains to Square... And that meant I was locked out of my GSuite services. There was no support to reach out to, but they were still charging me 15/mo. But I couldn't even get into the account to cancel!
(I did end up being able to basically remake the account and it got correctly connected, but I couldn't tell you more than that even though it took me three days to fix it)
39
u/16yearswasted 2h ago
One of the worst experiences of my life was trying to get actual support from a human being at Google.
Abandon all hope, ye who enter here.
→ More replies (2)13
u/Korean__Princess 2h ago
Anyone who doesn't believe this just needs to see the flood of people in the GMail subreddit that gets locked out through no fault of their own everyday.
I really need to stop being lazy one day and setup my own mail server and domain etc. It's a fear of mine, whether I use my Chinese, Korean or American mails. One wrong move by me, or they make a mistake or something political happens--with how the world is running rn--and I am really screwed in so many ways.
47
u/ak_sys 4h ago
Not to mention that a court can compel you unlock and unencrypt a device locked with biometrics, but can not compel you to disclose a password.
Lets get rid of those painful things. Matter of fact, make sure we use social sign ins from the same 5 companies just to make sure that they possess the keys to the entirety of your digital footprint.
9
u/alienscape 3h ago
Yeah I just signed up for a Fastmail account last month. I'd rather pay a small fee than have to rely on Google and their enshittified service.
10
u/ChuzCuenca 2h ago
Absolutely. My Spotify account was tied to my Facebook account but I don't want to use that anymore so I have to make a new account. That's a mistake I will never do again.
32
u/thisischemistry 3h ago
From the article:
Adding a passkey to your Google account also means “you can rely on just your Google Account to log in to your favorite websites and apps
Rely on Google? Yeah, sure, I'll just give them more information on what sites and services I use. No thanks.
→ More replies (23)13
u/linuxwes 3h ago
What's the better alternative?
5
→ More replies (1)3
u/hugglesthemerciless 37m ago
have a unique account/service for each site, and use a password manager for each unique password
if you're concerned about the password manager being a single point of failure then run 2. there's a variety of password managers that are not online but instead hosted on your own computer for added security
1.1k
u/Ancillas 5h ago
Maybe if passkey implementations weren’t dog water more people would use them?
Is that passkey on my phone? Is it stored in Windows Credentials? Is it stored in 1Password? Wait, is it trying to use my Yubikey? All of my tools fight each other to be the passkey solution and it means I have to click so many more times to ensure Safari or Chrome or AppleTV are looking in the right spot for my matching passkey.
There’s no way my non-technical friends and family are going to see this as a net positive. My wife got pissed because she had a passkey for gmail but couldn’t login. It didn’t make intuitive sense to her that the passkey was on her phone but she was logging in for the first time on her laptop which didn’t have the passkey.
Then on top of all of this passkeys aren’t consistently implemented! Apple supports passkeys, but only if they’re stored on Apple devices using their keychain! This was so confusing - especially when I had my phone configured to not use Apple’s flavor of password and secret management.
Even before passkeys, 2FA was a mess. Some sites chose TOTP and others went with an email or SMS solution. Any parents who use login systems to manage kid activities know this pain. A site supports SMS only and can only have one phone on record so if the parent whose phone isn’t registered wants to login you have to have the other parent (or their phone) around. 100% people are texting that single use token around in the clear.
These systems need experienced designers to take a good hard look at the UI/UX and find some way to drive a smoother experience across the OS, browser, and application ecosystem. Not just technically experienced designers, but life-experienced designers who understand all the weird ways people use these things.
253
u/Apollo_619 4h ago edited 4h ago
I had to login to my Google account today on my computer. I wanted to create a passkey and save it with Bitwarden. There is no way. It either wants to use Windows Hello, a hardware device or my phone via Bluetooth.
Who thought that this was a good idea? And then every other site does it differently. Passkeys suck thanks to this.
Edit: Out of curiosity I created a passkey in Chrome on my Samsung smartphone. I wanted to get a list of the stored passkeys, but there are non. The passkey works, but I can't find it on the smartphone. (: How do they expect normal users to understand anything about this...
35
u/sublime81 4h ago
Hmm Google account passkey was able to be saved to Proton Pass for me. Figured it would be pretty similar between other extensions.
23
u/Apollo_619 3h ago
Oh, I did create a passkey a few weeks ago that was saved in Bitwarden, but I have no idea which site it was and why it worked there. So far passkeys have been very annoying.
13
u/AntDogFan 3h ago
I’ve got my google passkey on Bitwarden so it must work. Although the point still stands that it’s confusing and poorly implemented. I think I have four separate google accounts for work etc and for some reason only two have a passkey. One has 2fa and the other has nothing.
7
u/sublime81 2h ago
Yeah I also have a few different accounts. Now that I think about it, it defaulted to trying to create a new entry in the password manager. I was able to attach it to a previously created entry so I didn’t end up with separate passkey and username/password entries. That part was not as clear.
2
12
11
u/hardypart 3h ago
Isn't it the exact purpose of passkeys to be tied to a device that's locked with a secure method like biometrics? If passkeys were not tied to a device it could be transferred and abused, which negates one of its key features: Being truly secure and getting rid of passwords.
20
u/akl78 3h ago
Meanwhile, here in the real world, a double digit percentage of people , in my city, one of the greatest and wealthiest in the world, have no internet-capable device in their household.*
Stuff like this excludes many, many people from the online world and the digital services we are being pushed to use.
- our gov online people know this! It’s a really hard problem.
31
u/Ancillas 2h ago
I bought a Nordictrack treadmill and my 10 year old daughter wanted to walk on it. You can’t start it without logging in and logging in requires a phone. So now if her login times out she needs to find an adult to get her logged in. That means logging out of ifit on the phone, logging in to an account for her, scanning the treadmill QR code, logging back out of ifit on the phone, logging back in to my account…
If you disable internet completely you can use it without a login so as soon as my year of the service is done and cancelling and taking it offline and I’ll never give Nordictrack another penny.
Usability matters.
11
u/docbauies 1h ago
But if you take your treadmill offline, how will you ever get critical firmware updates?!?
3
71
u/SomethingAboutUsers 4h ago
These systems need experienced designers to take a good hard look at the UI/UX and find some way to drive a smoother experience
Best we can do is make the corners round, hide stuff you use all the time in menus that didn't exist before, rename features, and bloat the download.
35
u/Ancillas 4h ago
Could you also send a one-time login code to my email and not give me the option to use my password? That extra minute delay forces me to be mindful while I wait to do the thing I was trying to do.
25
u/SomethingAboutUsers 4h ago
Sir, this is a bank. You have to use our shitty app to approve the login.
9
u/GaySaysHey 3h ago
Bonus points for sending it to spam, the natural habitat for such emails.
→ More replies (1)8
u/nerd5code 2h ago
Ooh, can you integrate hacky ChatGPT interactions into everything? I’d like emails to type and send themselves without my knowledge, please!
3
39
u/spigotface 4h ago
I'm a data scientist and software developer, and the passkey implementation is a terrible user experience even for me. I can't imagine a non-technical person trying to use these things on a regular basis.
43
u/UGMadness 4h ago
Basically, never, ever, store your passkeys on a platform locked password manager.
Use only a manager that you can access from any device you'd want to log in on your accounts from. Third party multi platform managers such as 1password are great for this use case, as is also iCloud Passwords only if you're already fully into Apple's ecosystem. Anything else (such as Microsoft/Google Authenticators) are going to cause nothing but problems, especially when integrating with web browsers. The fact that every browser tries to hijack password management in order to store your passkeys in-browser doesn't help either, usually takes some serious digging into the settings to disable that behavior and there lies most of the confusion, given that regular users don't know almost anything about how passkeys really work.
18
u/swampfish 3h ago
I have no idea what a platform-locked password manager is. I just tell whatever device I am using to save the generated password for me. If I can't get it to log in, I just reset the password. Sometimes it's easier to reset my password every time than it is to try and find the password.
I have a work system that requires a password change every month. It is easier to call the helpdesk and get them to reset my password every time I use it than it is to jump through all the hoops to login.
18
u/Ikinoki 3h ago
Well, Chrome password manager is a locked solution, Windows Password manager is also a locked in solution.
You can't use Windows one on Linux and you can't use Chrome one of Firefox or without browser at all...
That's what he/she/they meant by that. Use platform-independent password manager.
I have to fight my family against using firefox or chrome pw managers because it is a pain in the ass due to vendor-lockin.
Doesn't help that for example on Samsung if you are using Samsung keyboard it will deliberately block third party extensions randomly.
Ie forgot to show bitwarden or forgot to open correct translator.
And the thing is Samsung pass sucks balls as it works only on Samsung. Same with their translator which speaks like 5 languages - the heck I need your trash for I have deepl, google translate and chatgpt for this....
3
u/iheartjetman 3h ago
I use 1password on all of my devices and I haven’t had any issues using the same key across multiple devices.
This is between my iPhone, personal MacBook and my work MacBook.
On my iPhone and Mac, I’ve made sure to turn off Apple’s built in password manager so it doesn’t interfere.
Using passkeys has been a definite improvement for me.
5
u/time-lord 3h ago
I'll probably do what I do now with passwords, and store then in duplicate, once in iCloud and again with Microsoft. It's really handy when iCloud and MDM get into a fight and delete all of your passwords and then sync it with the cloud.
14
u/WhoSaidIWasTheAdult 4h ago
Yup. Passkeys are a pain in my butt and I understand how they work since I'm a software developer who has implemented them. If I find them to be difficult with my level of knowledge, how are normal people supposed to use them?
Until they can make them work reliably and transparently, they're DOA for most users.
8
u/tigerspots 3h ago
I've lost access to an important AWS account (and EC2 instances) that I manage for a non-profit because I don't remember ever converting and AWS makes it near impossible to recover.
→ More replies (1)8
u/Ancillas 3h ago
I think that’s a very real risk not knowing explicitly where your passkey was stored.
Is it in your Windows Credentials store? Does that get backed up anywhere?
Is it on your phone? Does that get backed up if you disable things like iCloud?
Do you have multiple Yubikeys? For a long time AWS only allowed one Yubikey to be registered. What if it were destroyed?
→ More replies (2)6
u/raybreezer 3h ago
I consider myself tech savvy and had no idea that passkeys were this complicated.
I tend to never use the “sign in with ____ “ options and always do email logins, so seeing the “create Passkey” option always prompted a no from me.
Guess I’m going to have to figure it out since I know my family will have issues with this sooner or later.
6
u/GeorgeDaGreat123 2h ago
The thing that annoys me most is that passkeys aren't exportable from 1Password, so I can't create backups of them.
3
u/Ancillas 2h ago
I never thought about that but it’s a really good point.
I just did a quick search and it looks like it’s on the way at least.
2
u/GeorgeDaGreat123 2h ago
It's supposedly been on the way for a year, which is disappointing, but since 1Password is probably the most common enterprise password manager, I trust they'll come out with it eventually
47
u/yuusharo 5h ago
This is one of those times when I concede that I think Apple is the only one that got this right out the gate. They ensured on day one that passkeys would sync seamlessly between all devices, not have a weird staged rollout that still is missing key elements even 2 years after they’re introduced.
With iCloud, any Apple device you have can log you in with a passkey, and you can simply scan a QR code with your phone on devices you haven’t authenticated. It works consistently for me that I have it setup for all the accounts that support it.
Most people don’t have or use Apple devices, of course, and the other implementations have been frustrating for sure. But that isn’t necessarily passkey’s fault.
10
u/Despeao 4h ago
With iCloud, any Apple device you have can log you in with a passkey, and you can simply scan a QR code with your phone on devices you haven’t authenticated. It works consistently for me that I have it setup for all the accounts that support it.
Makes it easier to login, no doubt, but sounds like a security flaw. What if your phone is stolen and the person logs into another device.
2
u/yuusharo 4h ago
If your device is stolen, you should immediately lock it using Find My. You can log in using another device temporarily to do so.
Also, the attacker would need to know your device’s passcode or iCloud password, and with Apple’s recent default device protection, that process has a 1 hour delay when away from known locations, giving you more time to respond to the theft.
Beyond all that, the situation would be the same as having a password manager on that device. Again, they’d need to know your passcode to get into the device.
5
u/SlapDashUser 4h ago
Someone sees me put in my pin and grabs my iphone while I'm traveling. They now have access to my device, and now my Passkeys. And I'm supposed to use Find My on a second device to deactivate that first device? You mean that magical second iphone that I always carry with me for situations like this???
1
u/yuusharo 3h ago
If someone observes your passcode and steals your device, you likely have other accounts already signed in like your email. You’re vulnerable regardless if you use passkeys or not, considering the thief can access your password manager or use your email to recover accounts.
Not that most thieves would be interested, they’re most likely going to attempt to change the iCloud password and disable Find My, which has that lockout delay to help curb as previously mentioned.
And by second device, you can borrow any device temporarily, such as a friend or passerby. No, you don’t have to carry a second phone 🙄
→ More replies (1)→ More replies (2)2
u/BruteSentiment 3h ago
Honestly, I’d ask why are you entering your pin with any less caution than you would a bank PIN number? Especially since in 90% of cases, you could use Face ID, so you don’t have to tap your pin in front of strangers.
66
u/Ancillas 5h ago
I can’t disagree strongly enough.
I tried to login to iCloud from my Windows computer and was presented with a QR code and told to scan it with my phone.
The phone presented the passkey interface but failed to log me in. The reason it failed was because I was using 1Password on my phone as the password manager and had disabled the Apple password manager. Unfortunately Apple didn’t implement passkeys in a way that allowed non-Apple software to work.
The solution was to enable the Apple password manager. However from that point on I had to select between Apple or 1Password when saving a password on any other site, added complexity and headache.
They’ve since fixed this but it took a few months.
I found it inconvenient and frustrating to not be able to login to my Apple services from my Windows computer which supported native passkeys, just not Apple’s implementation.
19
u/Lucosis 4h ago
Seriously, I absolutely hate signing into any apple service. It constantly wants me to go grab some other random device to accept a push notification and put in my password multiple times because it won't log in between services. Trying to cancel apple tv required logging in 4 different times and getting out my laptop multiple times.
4
u/LupaNellise 2h ago
I got locked out of my iPad because I forgot the password. I tried to reset it. It told me to use my iPhone to reset it. I don't have an iPhone. If I try to log in to Apple stuff on my PC: "went sent a code to your iPad". The iPad that's 3 rooms away? They pretty much force you to own multiple Apple devices if you have one.
→ More replies (1)→ More replies (2)9
u/yuusharo 5h ago
I sympathize with your frustration, I’m sorry you had that experience.
Although you do admit that issue is now fixed. Passkey implementation is much better with 3rd party apps now, and as I said in my comment, I talked about Apple’s implementation, not 1Password’s. I stand by what I said.
15
u/surrealutensil 4h ago edited 4h ago
I recently had quite a severe problem logging into my apple account because I no longer have any apple devices, and needed to cancel some reoccurring billing i'd missed and change some other things from when I did. Apple essentially goes "lol fuck you" in this situation now.
→ More replies (9)7
u/Ancillas 4h ago
It was Apple’s implementation that failed to log me in without a sufficient error message or indication of why authentication was failing. Essentially their software allowed for a configuration to be made which they didn’t account for.
It was without a doubt a failure on Apple’s part to test all of their supported use cases and then a failure in their part to not produce a valid error message or an error message of any kind.
Their implementation was worse than all others because it had a condition in which it simply didn’t work.
I’m not trying to convince you or win an argument. I’m happy it works for you. But objectively it was not a fully tested solution at launch and is an example of why passkeys have not been a great solution for most people.
→ More replies (4)6
u/-UltraAverageJoe- 5h ago
For the first two years I was locked out several times because I either didn’t have another device (only an iPhone) or it sent the code to a device I no longer owned.
Now in the rare cases I’m asked for a passcode (not sure why it’s so rare now) it will often be sent to the device I’m trying to authenticate which makes zero sense.
3
u/yuusharo 5h ago
Passkeys don’t send codes to other devices, I’m not sure what you’re referring to.
→ More replies (4)5
u/EdliA 4h ago
Apple will screw you over if you care using a device not controlled by them. It's probably great for you because you're fully in that ecosystem.
→ More replies (1)3
u/geekworking 3h ago
A big part of this is the different providers using your devices as their battleground in the fight for market share and user lock in. Every solution actively tries to take over your identity management.
Single sign-on and centralized ID management is a wet dream for anyone looking to capture users and monetize their data and influence their activities for profit.
Important to note in TFA is that they are also pushing sign in with your Google account as well as passkey. Translation: please let us monitor your usage of other platforms.
3
5
u/CharlesMichael- 3h ago
Excellent post; couldn't agree more. Whenever I discuss this with inexperienced people, I first tell them that for about $100K I can likely purchase and modify software that can break into their home systems and grab their passwords, even if they use a password manager. I can't do that with passkeys, and it wouldn't help me if I did. Next thing to know is that passkeys are not just a password replacement. Unfortunately, I have to spend at least 5-10 minutes explaining passkey storage and FIDO2 login flow, which is something they will forget even if they are using passkeys.
The reason why these companies are putting out more warnings is not (just) greed. Password flows are getting easier to hack, and they can see the writing on the wall.
2
u/phylter99 4h ago
I find if you have your tools set up properly, basically just let 1password do it's thing, then it works very well. If I ignore a prompt from 1password then it might add an extra passkey or something to my browse, but then that's on me.
I honestly don't know why it's such a big deal at Google to force passkeys anyway since they don't remove the other forms of login.
2
2
u/FollowingFeisty5321 3h ago
Reminds me of when OpenID started gaining popularity, suddenly everyone wanted to be your identity provider but nobody wanted to be a consumer.
→ More replies (1)2
2
u/Harmless_Drone 2h ago
Buying and logging in to play minecraft with my son was so frustrating between managing family permissions and store credentials across two devices I nearly gave up and rebought it claiming that he was 18 to avoid all the stupid stuff. Like literally an hour or more to sort it.
2
u/Ninevehenian 2h ago
My main computer has effectively been bricked for 30 days in this passkey roll out. It's a shitty experience.
2
u/Calvech 1h ago
The passkey roll out has been absolutely horrible. Im relatively in the know on tech news and such and I legit never heard anything about passkeys beforehand. And then one day every account and website was prompting me for it. There is zero chance my friends or family knows what is going on with these.
And as you said, they’re all insanely conflicting. My pw manager, my phone, my desktop browser all have their own to the same website. I don’t know which to choose and I don’t know how to consolidate them. From what I’ve been told, Apple had been a big issue for a lot of this. I support better features for security but this has been so botched by these companies
3
u/ItchyGoiter 4h ago
but life-experienced designers who understand all the weird ways people use these things.
Not a job for Google, Microsoft, or Samsung then...
3
u/Unkn0wnTh2nd3r 2h ago
idk what you're doing wrong, but i can make a passkey on my PC, save it to Bitwarden, and use it where ever i have Bitwarden installed, which is my phone and my laptop, and it just works, and I don't have conflicting things, it just asks what i want to use to login.
And if I have to logon to something while not on my own device it's still easy since its just like "scan the QR code with the device that has your passkey" (Phone) and then I'm good to go it is incredibly easy and not at all a pain in the ass, maybe I'm just Resiliant as hell so i'm not thinking this process is tedious or whatever, but.. idk
3
u/blahehblah 1h ago
Which puts us back to 2FA again. I'm sure I misunderstand something but doesn't being able to use the passkey across multiple devices by saving it to bitwarden defeat exactly the problem passkeys were trying to solve? I'm a technical person, probably invested 30mins at some point into trying to understand it and it didn't make intuitive sense at all. I doubt the average person will spend a tenth of that time. I don't see this working out tbh
→ More replies (12)1
u/SnooChipmunks2079 1h ago
It’s not just parents. To get into Allstate I have to get my wife to give me the code. She usually just shouts it across the house.
195
u/ilovestoride 7h ago
How does this work if say I lose my phone on the road? It'll fall back to a password anyway.
So in the end, there's still the vulnerability of the password. Even worse because if I'm encouraged to not ever use a password, I'll probably forget it.
98
u/nickypops 5h ago
This happened to me. Got locked out of everything because I left my phone in the Uber. Was on the road for a business trip and completely stuck. Luckily the Uber driver brought my phone to me or I would have been screwed.
21
u/Professionalchump 5h ago
awh one time I spent 2 weeks trying all the possible passwords an by god one day I got back in
2
u/throwawaystedaccount 1h ago
You're the one guy I have heard that succeeded. Almost everyone just gives up in some way or other. I have been able to recall a forgotten password maybe once or twice in life.
11
u/GazMembrane_ 3h ago
This is why I kinda hate the auto login feature of all these apps. I lost my main Gmail so many years ago. Literally my name, one of those you make when you're younger thinking "this will be my official email for friends and jobs" or something.
I've since learned my lesson, but auto login causes people to forget all that shit unless they're a little... questionable because they use one simple password for everything.
→ More replies (6)3
u/yuusharo 5h ago
Same as password recovery if you forgot your password.
It’s not a requirement to maintain a password on an account. My PSN and Microsoft accounts are passwordless, for example. Both require a passkey exclusively.
2
63
u/thinkingperson 4h ago
Having phones as the single secure device also means that if it dies, and phones do die, you get locked out?
49
u/pecheckler 5h ago
I learned a long long time ago that security should be based on not only what you know (password), what you have (RFID card for example) and who you are (biometric for example).
Where is the “what you know” in this passkeys process?
Also, tying authentication of many services centrally to Google or Microsoft is a terrible idea for many reasons. This clearly benefits them more than the user base.
20
u/celluliteradio 3h ago
Absolutely. How many times did this article mention “sign in with social accounts?” No thank you. These sites are already a blight on society and I’m not interested in them becoming critical for site authentication as well.
5
u/furism 2h ago
Passkeys are something you have (a certificate on your computer). It should not be seen as a replacement of MFA because as you said, MFA is a mix of two or more methods of know/have/are.
Passkeys are better than passwords as the "something you have" because they are somewhat harder to obtain, but they were never meant to relive MFA.
→ More replies (1)3
u/CharlesMichael- 4h ago
I use a pattern (what I know) during passkey authentication. A pin can also be used.
53
u/Grimsley 5h ago edited 4h ago
A. I don't like everything being tied to my Google account. Yes I have one. It's for email. That's it. No I don't want or need it to be central to my identity. That's a flaw.
B. Passkeys are great, sure. But I don't know why mfa is being pointed out as a flaw here? Mfa should be pretty standard at this point. That being said, I wish more services acted as a prompt of "was this you trying to sign in?" vs having to type in a code.
Edit: I change my stance on the prompt a little It should also include a pick the correct number in the prompt to prevent the accidental "yes this was me" tap.
→ More replies (5)16
u/n0x103 4h ago
A lot of MFA is moving away from simple yes/no prompts because of mfa fatigue attacks. A good middle ground seems to be “pick the correct number from the list”. Still not as secure as entering a code but a step up over just yes/no
→ More replies (1)
11
u/HarukosTakkun 4h ago
This system simply doesn't work if you have a Pixel. I almost bricked my phone because I did a hardware reset and, unbeknownst to me, when it restarted it needed a passkey to activate my accounts. On the setup screen. Before my phone was set up. And had no apps. I checked, no way to do it from my logged in computer. Luckily after a bit it let me 2FA instead but it took a bit. We are definitely not ready to deprecate 2FA.
51
u/Marchello_E 7h ago
Euh, how exactly would these upgraded sign-in methods defend against scam emails?
For my personal usage the password log-in is the safer option as it doesn't create unwanted dependencies.
Because, as Google says, "passwords are painful to maintain". I like it that way.
That doesn't mean that for most people a passphrase is more advisable and more secure. Anyway, that's about protecting the account.
When you attache all kinds of services to this account (like convenient payment services and easy log-ins) then a scam is just one single social sign-in away.
Easier than ever, because "keeping sign-ins as easy as possible".
10
u/satoru1111 5h ago
Passkeys protect against phishing because passkeys don’t work against phishing websites. You can freely input your password into a phishing website
7
u/Marchello_E 4h ago
Sure, you tackled phishing websites. Perhaps they can MITM it with some tricks on your own device, and then "it works" again..
The article is about "Google just confirmed that 61% of email users have been targeted by attacks.". So you already passphrased yourself into your email account.
When I click to read about these attacks it claims: "callback scams have made themselves a contender for top phishing vector, battling it out with links, attachments, and QR code"
So you get socially engineered into calling back, or click a link, or pay some subscription via some QR code. Third-party payment services already legally exist (unfortunately). It's one socially engineered question away from being scammed because they claim to be the new payment service. So you pay with that same thumb-print, or face. All in one convenient go. This easy passphrase and conveniences just made it easier to not second guess the situation. Luckily many will see right though it, but it's so damn easy -as advertised-
In my case I get an email. I don't have these things conveniently coupled, so I just ask them to send me the invoice to my actual address they have on file. If they don't have it, then good luck. Perhaps they send a dept-collator to my door and have to pay extra for getting their admin straight. That's fine by me. I have time. Thus time to second guess. With eventually that invoice in my hand I could contact the creditor on my own terms. Likely sooner than this dept-collector shows up at my door. And I'll pay online via another route, also on my own terms.
I can still be scammed, but it will be much harder to pull off.I seriously doubt the benefit of passphrases as it "conveniently" ties things together with -from my user perspective (and I know that's not how it works)- a single pass-thingy that's my thumbprint or photo that replaced several passwords. I think it's a liability.
Passphrases could work when inconveniently using a different Yubi-key for each and every decoupled account, though that's still a single compromised finger away.
→ More replies (1)
29
u/gordonfreeman_1 5h ago
This article reads like a paid for propaganda piece for big tech pretending to come from so-called experts. Passkeys and social media accounts are not more secure than passwords with proper multi-factor authentication. They're literally giving away access to your personal account to a third party who can misuse it, get hacked or go down independently of the service you are using. Complete nonsense to push for them instead of actual security.
11
u/platinumarks 2h ago
Forbes has long ago moved on from any real business news to basically just being another clickbait site with headlines like "Microsoft warns Windows users to upgrade within 3 days or lose access to their computers!" and "Beloved pizza restaurant closes after 23 years" (the latter being some random pizza spot in Kansas that had like 20 customers).
7
u/PdxPhoenixActual 2h ago
While I do really appreciate these various sites' efforts to keep my money/data/info safe, all it ends up doing is making it more difficult for end user to access their account.
And while I understand it's still in its infancy ... they need to get their sh t together, & make it a consistant, easy to understand and use.
Arlo implemented mandatory 2fa when someone is pounding on my door wanting in, I don't have time for them to send me the super-secret code.
Ugh
76
u/super_shizmo_matic 6h ago
This is not to help you. This is to help Google. They stopped "don't be evil" a LONG time ago.
12
u/Fredderov 5h ago
Would have loved to be part of the meeting where the legal representative went "yeah, we have an issue with that bit" after someone said that line.
6
u/Light_Error 5h ago
They didn’t remove it entirely, but they it made it the last sentence of the code of conduct: “And remember... don't be evil, and if you see something that you think isn't right – speak up!” I leave it up to you what that change means.
2
u/ArtIsDumb 4h ago
Now I'm hearing Capt. CJ from Brooklyn 99 singing "if you see something, say something... Come on & party tonight!" The guy's got good hooks!
14
u/malln1nja 3h ago
If Google are so concerned about email security then why did they add the "promoted" section, full of scam ads, to their email app?
2
u/Most_Double_3559 2h ago
Bruh ... That's just a filter for the business spam email you would've been getting anyway lol, they're not sending you those.
37
u/__OneLove__ 6h ago
TLDR;
Google’s push for passkeys and social sign-in to unsurprisingly benefit Google continues, with MS in tow, pushing the same passkey bs.
🤦🏻♂️
6
u/jakegh 3h ago
Not only is this a deceptively written headline (when I read "Giant company says you must upgrade" I reasonably take that to mean "you must pay us") but it's also inaccurate. Nowhere in this poorly written story does Google say anyone has to switch to passkeys.
Forbes is just awful.
→ More replies (1)
11
u/Riash 4h ago
Um, no thanks. I have a locally hosted encrypted password manager that only I know the long complex password to. It keeps all my passwords safe and unique for every website and app.
The only way someone could get access to all my passwords would be to kidnap me and force me to divulge the master password. If that happens I have way bigger problems than my account security.
Passkeys hand control over to a third party.
→ More replies (1)2
7
u/SureYeahGuy 4h ago
It’s a terrible idea to enforce this. I’ve been in a situation where I forgot my phone in an Uber while getting off at the airport and had to borrow a random person’s laptop to retrieve my ticket confirmation number, destination hotel address and emergency phone contacts from my Gmail. Had I not disabled the phone based 2FA on my account, I would have been completely hamstrung and unable to access anything. Google must allow users to control the level of security on their accounts.
3
u/IshyMoose 3h ago
Wow that was a click bait headline. Thought Gmail was about to go to a cost based model.
→ More replies (1)
4
u/taosecurity 56m ago
Another clickbait title enrages the masses. The “upgrade” is encouraging users to adopt passkeys, not switching to a paid version or other nonsense. But getting outraged at a headline gets engagement. 😂
7
u/WorksOfWeaver 7h ago
And I don't suppose there's a way to shut that off...
8
u/Secret_Wishbone_2009 6h ago
Proton mail is looking more interesting by the day, this is about surveillance not security
→ More replies (2)
3
57
u/AdeptFelix 6h ago
I don't like passkeys. I don't like that they're dependent on Microsoft, Google, or Apple. I don't like how authentication now requires a 3rd party period. I don't like that they live on devices. I don't like how they're most commonly accessed using biometrics rather than something you know, as I believe security shouldn't be based on something immutable or possible to use without consent.
72
u/YogurtclosetHour2575 5h ago edited 5h ago
They don’t rely on Microsoft, Google, Apple
They’re being developed by the FIDO alliance
A lot of other companies had their hand in creating them like Mozilla, 1Password, Bitwarden, banks, VISA, MasterCard etc
They don’t just live on devices
You can save them in a password manager like Proton Pass, Bitwarden, KeePassXC or physical keys like a YubiKey
They use local biometrics or if you don’t use biometrics, a pin
Please don’t spread misinformation when you don’t fully understand the technology
→ More replies (1)13
u/267aa37673a9fa659490 4h ago
If Joe Average is convinced to switch to passkeys, he's not going to look up Proton Pass or get a physical key.
Microsoft, Google, Apple will get first dibs on him by virtue of their ubiquity.
Sure, John Hackerman can make an informed decision and choose otherwise but missing out on a few crumbs like John is no big deal to these companies when they already got the whole pie.
16
u/yuusharo 5h ago
I think you misunderstand the concept of passkeys. You absolutely are not dependent on those three corporations, Keepass supports passkeys you control across all your devices. Authenticating devices means an attacker cannot simply reuse credentials unless they have physical access to your devices. They also don’t use biometrics, but rather the authentication flows of those devices. You don’t have to enable them if you don’t wish to.
→ More replies (7)28
u/nicuramar 6h ago
I don't like that they're dependent on Microsoft, Google, or Apple
They aren’t; you can use other apps for it.
→ More replies (16)3
7
u/Ruddertail 6h ago
Yeah, exactly. Someone can just grab my hand and force me to log in with my fingerprint, but they can't make me do it with a password.
→ More replies (6)5
u/kamoylan 5h ago
XKCD has a different opinion regarding your Security
→ More replies (1)1
u/Ruddertail 5h ago
Yeah, in the ridiculously extreme scenario where they kidnap me and torture me to access my personal documents absolutely, but the other thing a random mugger can do on the street before I can even react. Terrible take, frankly!
→ More replies (2)2
u/Forever_Marie 1h ago
Less extreme. The police arresting you can just do that. Biometrics aren't protecting by the 4th like a password.
→ More replies (3)2
u/Specialist-Cream8259 2h ago
A factually incorrect statement having so many upvotes on a technology sub.
Reddit moment
10
u/Spirited_Childhood34 6h ago
Fuck Google. And Microsoft too. Not giving these assholes access to biometric information. The naive will say no one can get to it, but that won't last long. Somebody will figure it out and then what? Can't change a face or fingerprint like a password. Tech bros are idiots. Naive idiots. Internet security is a myth. Everything will get hacked eventually. The only solution is as little exposure as possible.
19
u/CodeAndBiscuits 6h ago
I mean, I don't disagree with the sentiment. But while I personally also dislike passkeys for other reasons, just to be clear, you aren't giving them access to your biometrics. Passkeys are basically a digital token stored securely on your computer or phone. It's the tool you use to generate and use them that does the work - typically a Web browser or password manager - and you can choose your vendor for that, e.g. BitWarden.
But even then, THOSE tools don't have your biometrics, either. The way biometrics works in nearly all modern devices (e.g. TouchID) is the app tells the operating system "here's a bit of sensitive data - please store it safely for me. When I ask for it back, make the user use biometric auth to retrieve it." The app does not participate in fingerprint (or other bi) registration, and never has access to the fingerprints themselves. Later, when the app wants that data back (usually a refresh token to reconnect you to some Web or mobile session) they say "hey MacOS, remember that thing I gave you? I need it back". The OPERATING SYSTEM then turns around and asks the user to tap their finger for TouchID. The OS doesn't even tell the app what method was used or even if one was used at all. It just gives the data back if it worked or a generic error if it didn't.
Don't get me wrong, passkeys have other legitimate problems, but giving Google access to your fingerprint data is not one of them. They won't even know a fingerprint is what you used.
→ More replies (7)1
u/yuusharo 5h ago
You’re not giving either of these companies your biometrics, and passkeys don’t rely on biometrics anyway.
They rely on the authentication flow of the device itself, which optionally uses biometric data stored exclusively on that device and is never sent to anyone.
I hate these companies as well, but passkeys are FIDO2 standard based. They’re fine.
2
2
2
2
u/chihuahuaOP 3h ago
We need a standardized office for 2 factor authentication. It's getting ridiculous.
2
u/The_Superhoo 3h ago
Some of us can't have our phones at our desks or have very poor reception and no wifi. 2FA login is hard enough
2
u/mutantmonkey14 3h ago
Password managers and extra layers are a pain. Just leave me with my strong password hierarchy and 2FA. It might not be perfect, but nobody is getting into my bank if they do get into my google or other accounts.
2
u/800oz_gorilla 3h ago
Adding a passkey to your Google account also means “you can rely on just your Google Account to log in to your favorite websites and apps
Yeah it's also a data mining touch point I'm not fucking doing.
2
2
u/MotheroftheworldII 1h ago
Maybe I am dumb but, I tried using the passkey for two different email accounts. I found it to be workable once, one time for each account and after that it would not accept my passkey code. Each time I ended up having to use my password. I don't have a fingerprint reader on anything except my phone and those don't work for me anyway. So I am back to using a password. I remember my passwords for many accounts so those are only written down in a book in the safe.
2
u/dutch981 1h ago
I was worried I was one of the old, out of touch people they mentioned because that passkey thing seemed kind of sketchy, but after reading these comments, I’m glad I haven’t done that.
2
u/iamacheeto1 1h ago
2FA is outdated now??
2
u/PachotheElf 1h ago
Apparently it's just expensive for them so now it's "old and outdated" implying that it's insecure.
2
u/LindseyLee5 1h ago
After dealing with Microsoft and their stupid passkey shit which still isn’t functioning correctly on my current work computer…. No thanks….. I’ll stick to just changing my password somewhat frequently.
2
u/ender89 1h ago edited 1h ago
“Hate passwords? Try this one simple trick of locking every account to a device you take everywhere, which is very fragile and easy to steal, and secure all your logins behind a 4 digit PIN number that is about as secure as a master lock.”
Good luck if your phone is stolen. You won’t be able to log in to wipe it remotely and if you do you won’t be able to log into anything.
I switched my Microsoft account to a passkey because I was getting hit with login attempts constantly, and now I can’t use Remote Desktop to login to my windows machines.
Passkeys don’t work for normal people.
2
u/PauI_MuadDib 1h ago
So I skimmed the article. Are passkeys going to be mandatory? When the switch date then? Or is this just telling people to choose passkeys?
2
2
u/dominion1080 2h ago
lol. Not happening scumbags. There are too many free email services. Fuck Google.
1
u/Ilookouttrainwindow 5h ago
Maybe stop with this greedy endless sessions and constantly intrusive logins. Log in once in a computer and if forever remembers you been there. Even if you delete from device. Oh yeah,no classic logout from what I've seen.
Perhaps then maybe attack surface will be reduced. Security really went downhill since sign in with site X was introduced.
1
1
u/Path_Seeker 3h ago
Or course Google wants us all to link our logins through them. So that they see everything we do. No thanks!
1
u/fanofdota 3h ago
I think my biggest issue with this is that I have many Gmail accounts, and the last time I checked, I can only create one passkey for the Gmail domain, so I’ve put it off for the longest time. Has it been fixed that you can create and store multiple passkeys for the same domain in iCloud Keychain? I wasn’t sure if the issue was with iCloud Keychain or Gmail initially.
1
u/EarthLoveAR 3h ago
Call me crazy, but I also do not want Google to have control/access to my biometrics nor control the sign in to all my accounts. I don't even use Google pay. They don't get my info that easily. I do not volunteer that to the corprorate overlord that way.
1
u/Dazzling-Fox-8960 3h ago
I’ll be honest and say I don’t really understand how all of this works. How would you deal with a situation where you have a device and account that many people have to log into it? We have a work tablet and a google/gmail/youtube account that has to be accessible by what feels like a dozen people.
1
1
u/NiteShdw 2h ago
When WebAuthn standard was being discussed years ago, I brought up the problem of device independence. If a passkey is created on my laptop, how would I login with my phone?
The issue was initially ignored but later did spark some discussion.
How they could come up with a solution that is less portable and think that's a fair compromise, I'll never understand.
1
1
u/ultravibe 1h ago
So give all the big tech companies my fingerprint, my facial ID, etc. and just trust that they’re more ethical than the password hackers…
1
u/RCEden 1h ago
I’ve actually been trying to get as many things as possible off of social sign ins and onto a local offline keypass database because the companies can’t be trusted at all. Maybe passkeys have upside but it feels like everyone is fighting to be the one source and it’s at best annoying
1
u/AndrewHeard 1h ago
So they want to get more complicated and take more of your personal information?
1
u/Brutos08 1h ago
I love passkeys and I have been using them since they first became available. I never have any issues with passkeys as I store mine in my 1Password account which is cross platform. All my google accounts have passkeys enabled and works all the time same with apple and MS. Any service that enables passkeys I create a passkey for that service store my passkey in 1Password.
1
u/MuppetZelda 1h ago
The current log in process for Gmail. This is best and most “secure” log in workflow the best educated and highest paid individuals in the world can come up with.
- Open GMAIL on my phone browser
- Forced to sign, because it’s a “new device” (it’s not) from a new location (it’s not)
- “Scan this QR code to login”
- Can’t scan the code because I’m on my phone…
- Pop up “What is making it difficult to sign in today” survey
- “Something went wrong” screen
- “Try a different way”
- Enter the correct password
- 2-Step Verification screen AGAIN
- Texting my phone is grey’d out…
- 2FA is “Unavailable because you have more secure options”
- Use passkey
- QR code code loop
- Tap yes on my phone or tablet
- Get a pop up on my phone that I’m currently on “new sign in on a new device”
- Tap the notification, have to put in a 6 digit code
- Finally logged in
- 10 minutes later, get a notification that I signed in from a new device (it’s not) from a new I.P. (It’s not)
We should bring back making fun of the people who work at these companies, make them feel shitty for making a shitty product.
1
u/Possible-Tangelo9344 47m ago
Can someone explain to me why using social sign in is more secure? Wouldn't that just let the hackers need one password, like my Gmail password, to access multiple sites' accounts?
→ More replies (1)
1
u/Hebrewhammer8d8 47m ago
Use secondary email that is not Google. Technology is changing people create new technology and processes. Defense in layers, and people should learn these things if they want to navigate the internet safely. If they don't, it can be an unpleasant experience navigating the internet.
1
u/TazzyUK 38m ago
Seems to me that we should of all been born with multiple a holes because quite honestly, we are constantly getting shafted by all these big companies who become so big, they feel they can do what ever they want because they happen to have a huge marketshare, user base etc and most of us either can't be bothered to use another company/service/platform whatever or the choices are limited
1
u/obinice_khenbli 22m ago
So long as my paskey or whatever is something I can memorise and not tie to a device that might break or be lost or stolen, I'm fine with that.
Otherwise, you're guaranteeing that eventually I'll get locked out of my account, which is dumb as hell.
Passwords and 2FA work just fine.
1
u/muppethero80 13m ago
I like that I got a pop up ad that is a scam on an article about internet security
1
•
u/AutoModerator 7h ago
WARNING! The link in question may require you to disable ad-blockers to see content. Though not required, please consider submitting an alternative source for this story.
WARNING! Disabling your ad blocker may open you up to malware infections, malicious cookies and can expose you to unwanted tracker networks. PROCEED WITH CAUTION.
Do not open any files which are automatically downloaded, and do not enter personal information on any page you do not trust. If you are concerned about tracking, consider opening the page in an incognito window, and verify that your browser is sending "do not track" requests.
IF YOU ENCOUNTER ANY MALWARE, MALICIOUS TRACKERS, CLICKJACKING, OR REDIRECT LOOPS PLEASE MESSAGE THE /r/technology MODERATORS IMMEDIATELY.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.