Hacker Newsnew | past | comments | ask | show | jobs | submit | altmind's commentslogin

Passkeys are the easiest way to lose access to your account.


It’s no big deal. Just contact Google’s helpful customer service. I’m sure you’ll get a response.


"no."


Prolog as a security model.


have you tried calling their hotline ;)


If you have paid for google one, as I have, the help desk is real people and they are nice and responsive.

I appreciate the corner case catch-22 "you need to be logged on to prove your status" but please, don't perpetuate the meme there is no google help desk.

If you want google help desk, pay Google for support.


Ah, excellent. Every website I visit, at Google's behest, has added a Google support contract as an unwritten requirement for doing business with them.

I'm glad that's fully resolved and indicates that the new world order is no worse than the old, and it definitely proves that Google doesn't have ulterior motives in this initiative.


If you use a google passkey, who do you think is your support channel when that passkey doesn't work or you lose contact with it?

I'm struggling to see what the issue is.


There are two huge problems with that.

(1) Google "strongly encourages"/tricks you to create a passkey even when you don't know what that is or want one and doesn't explain the downsides like having to suddenly pay for support.

(2) The status quo is that I can create any password I dang well please for any website, but the new world order is that Google gets to snoop on my affairs and intervene on the website's behalf, and since nobody will implement anything more than the bare minimum I'm going to be beholden to Google for normal day-to-day activities where I wasn't before. Maybe I could buy an iPhone or three and be beholden to Apple and/or Google. Either way, it's not a good world.

Yes, it's perfectly reasonable absent any other facts that if Google owns my passkey then they're the people I should pay for support. What's happening instead though is:

- They're lobbying websites, apps, and developers, trying to push passkeys as more secure and the future of the web.

- All the "getting started" guides only have enough details to actually implement Google and maybe one or two other big actors as providers.

- When people have the audacity to sign in with their usernames and passwords, Google interrupts their flow to tell them about how great passkeys are and how it's critical they make one. They don't mention a thing about how irreversible the process is or how it has zero benefit to the user. The UI is slow and janky, so the accept button is likely to accidentally appear over other things the user planned to click. 100k software engineers somehow can't figure out how to debounce on redraw, so that misclick will permanently infect that person's account.

And so on. I don't want to use Google for passkeys. At all. The near future doesn't, however, look like one which is amenable to me owning my own signing credentials. I won't have a choice in the matter. My choices are to pay Google (and/or some other megacorp with a direct, by order of the courts nondisclosed, line to DOGE and friends) or GTFO.

In the early 1900s this had names like "protection money." More recently we've seen terms like "regulatory capture." Whatever the exact nomenclature, it's terrible. Google is force-feeding a bad solution into the ecosystem and using their clout to ensure that they own a big, steaming piece of the bullshit pie we're cooking.

That's the issue. If I buy a support contract from you and complain that GGM is the worst acronym in the world then that's one thing. If you beat my colleagues and I with a wrench till I fork over my hard-earned dollars and loudly proclaim your sainthood whenever I've healed enough from the attack to speak my mind then I don't think I'm the problem, and those saintly/googley claims will hopefully fall on deaf ears.

The world isn't as black and white as just looking at who has control of the passkey.


And you expect every one of Google's billion users to understand this distinction, and to be fully aware that services constantly marketed as Free actually need to be paid for?


No, thats also a mis-statement. Google gives away free, and google sells higher tiers. Google one is a higher tier. This is no different to any other provider of a service with a free tier. It's not marketed as "free" -It's marketed as the level above free.

Things above free have to be paid for, they aren't marketed as free.

A more reasonable, less argumentative response might be: "did you want them to offer helpdesk to free users" -which in fact, I did, until somebody pointed out the ARPU of a customer, and the cost of helpdesk (this is actually an anachronism, that was pointed out to me when I worked in a dial up ISP) -Whatever profit you extract from a low tier customer (of which free is the lowest tier) is very quickly eroded when you have to pay the staff who operate the helpdesk, and a customer calls in wanting helpdesk support.


What is “Google One” and does paying for it act like an insurance policy to get you human support when shit hits the proverbial fan?


Google one is the paid tier of google for ordinary people, predicated on buying more storage. If you pay google to get more than the 15GB you are on google one and you've become a customer.

There are other forms of customer, GCP tenants, Google G-Suite, Google Workspace. If you pay google for these services, you get helpdesk directed at those services.

Google one includes your base google account. You can ask them about things unrelated to just having more storage, if it's within the compass of that level you paid for.

Google one has helped me when minor amounts of shit, a few clods short of "I lost my passkey" hit the proverbial fan.


This got me to check Bitwardens account export, which does not include any private keys making the backup "incomplete" in terms of importing it into a separate platform.

I guess this is by design, the user can't self "own", but they also cant self own the data. It does look a bit like lock-in though.

I was recently looking at Pocket-ID as a SSO for my home lab, which only supports passkeys by design. In that context I can probably hack the gibson and get into my accounts if something went wrong, but it does make me uneasy about a future where most sites only accept a passkey.


Bitwarden says that "Passkeys are included in .json exports from Bitwarden." I'm not sure if it's true but it should be there by now.


Actually I may just misinterpret the JSON. It only includes `keyType=public-key` and `keyValue=...`, I was expecting there to be `keyType=public-key` and `keyType=private-key`, but perhaps keyType is impliying the authentication method and the keyValue is my private key?

They certainly are included, but whether they're included in a way that you can use them elsewhere, vs re-importing them into the same bitwarden account (something their vault has options to do if you encrypt the export), I'm not sure. I should spin up the vaultwarden clone and see if it correctly imports it.

    {
      "passwordHistory": null,
      "revisionDate": "2025-08-04T03:02:03.600Z",
      "creationDate": "2025-08-04T03:02:03.140Z",
      "deletedDate": null,
      "id": "<UUID>",
      "organizationId": null,
      "folderId": null,
      "type": 1,
      "reprompt": 0,
      "name": "abcdef",
      "notes": null,
      "favorite": false,
      "login": {
        "uris": [
          {
            "match": null,
            "uri": "https://<URL>"
          }
        ],
        "fido2Credentials": [
          {
            "credentialId": "<UUID>",
            "keyType": "public-key",
            "keyAlgorithm": "ECDSA",
            "keyCurve": "P-256",
            "keyValue":  "<238 chars>",
            "rpId": "<URL>",
            "userHandle": "<SOME BLOB>",
            "userName": "abcdef",
            "counter": "0",
            "rpName": "abcdef",
            "userDisplayName": "abcdef",
            "discoverable": "true",
            "creationDate": "2025-08-04T03:04:34.418Z"
          }
        ],
        "username": "abcdef",
        "password": null,
        "totp": null
      },
      "collectionIds": null
    }


Seems you can only import to the same account, some hand gesturing at FIDO Credential Exchange Format & Credential Exchange Protocol which aren't yet ratified.

https://community.bitwarden.com/t/passkey-portability/59177

https://community.bitwarden.com/t/passkey-export-file/77448/...


I just migrated to a new Bitwarden server using their JSON export/import and it included my passkeys.


cancelling a scheduled press-conference without signing a deal is not major?


Do you believe that they actually read that "deal", that everything had already been agreed upon, and then it just so happened that they had an argument in front of journalists and that's why they didn’t sign it?


who are "they"?


Cahtgpt is quite good for known problems before 2022, since the questions got into the training set. It's quite bad for new interview questions though.


Discover bank?


Its not only news service. Few services are left under the Yandex INTL. What are the services - ... you gotta know... they haven't published a proper disclosure, only couple of press-releases, which is alarming for a still part-public traded co.

I remember some sources that they've sold ALL their media services, and the INTL is only left with services like taxi and delivery.


i've seen more comments in russian than in english. what's your numbers?


Would be nice to see how hugepages and THP affect performance too


For big pieces memory at least, a lot. I was talking to someone the other day about this, they said that in their kernel, switching to huge pages for mapping physical memory made the boot faster by a factor of 10000. I don't have the measurements though.


I don't see people hating bill gates, the whole premise of article did not make much sense to me. Hackers used to hate him but only because window's success eating the other computing environments.


20 years ago people absolutely did hate gates


It’s not about Bill Gates, he was just mentioned because he was included in the linked YouTube clip. And people abs hate him as evidenced by the links in the article to people thinking he is chipping them


The article premise is a little funny: people hate Gates and Zuck; it is strange that people hate Gates, so I'll set that aside and consider why people hate Zuck.


Yeah I didn’t mean to put emphasis on the Gates part, he just happened to be included in the video. But good feedback


he's putting microchips in the vaccines and helping the government put sodium chloride in food



a lot of people were scratching their heads on how to put optane to use. a fast ssd? or a slow DRAM? with a propietary api? and requiring support from the hardware platform? the whole product line was inconsistent as they use the same name for both storage devices and NVDIMM.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: