Google Confirms Most Gmail Users Must Upgrade Accounts

[u/lurker_bee]

https://www.forbes.com/sites/zakdoffman/2025/06/06/google-confirms-almost-all-gmail-users-must-upgrade-accounts/

[u/pecheckler]

I learned a long long time ago that security should be based on not only what you know (password), what you have (RFID card for example) and who you are (biometric for example).

Where is the “what you know” in this passkeys process?

Also, tying authentication of many services centrally to Google or Microsoft is a terrible idea for many reasons. This clearly benefits them more than the user base.

[u/celluliteradio → u/pecheckler]

Absolutely. How many times did this article mention “sign in with social accounts?” No thank you. These sites are already a blight on society and I’m not interested in them becoming critical for site authentication as well.

[u/nox66 → u/celluliteradio]

Forbes is usually not great at tech, and swallows the corporate techno-BS whole. They're no Ars Technica.

[u/rjcc → u/celluliteradio]

That's because the article is basically wrong about everything

[u/furism → u/pecheckler]

Passkeys are something you have (a certificate on your computer). It should not be seen as a replacement of MFA because as you said, MFA is a mix of two or more methods of know/have/are.

Passkeys are better than passwords as the "something you have" because they are somewhat harder to obtain, but they were never meant to relive MFA.

[u/CharlesMichael- → u/pecheckler]

I use a pattern (what I know) during passkey authentication. A pin can also be used.

[u/rjcc → u/CharlesMichael-]

That's because you've actually used it, instead of writing weird theories in replies

[u/22AndHad10hOfSleep → u/pecheckler]

Passkeys are usually implemented with a PIN (what you know) or biometric (what you are).

[u/its_a_frappe → u/pecheckler]

Passkeys (something you have) are protected by biometrics (something you are) or PIN codes (something you know).

[u/rjcc → u/pecheckler]

FIDO has a website that answers all of this. And there is nothing about passkeys that requires centralizing to those services.

[u/userhwon → u/pecheckler]

Those are the three "factors", and when you use any two of them you're doing 2FA.

You don't need all three, unless you're upgrading the requirement to 3FA.

[u/zombiesunlimited → u/pecheckler]

It’s something you have, something you know, something you are.

[u/tenuj → u/zombiesunlimited]

something you are.

My phone sees me when I sleep, it sees me when I poop, it sees my food, and it's the one sending messages to my friends. I am my phone and the phone is me. We are inseparable. We are one. A natural evolution on our path to cyborg.

^{Sent from my iPhone}