topic Re: Passkeys for Google Workspace accounts - are you in or are you out? in Peer-Peer Topics

Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Wed, 14 Jun 2023 20:07:39 GMT

I feel it is a good talking point, as it will definitely be something people will be interested in using for Workspace in the very (near?) future, and admins may have to decide whether to allow it, which I absolutely recommend for all who don't force 2FA, and would probably recommend even then, as that 2FA becomes 3FA (by some definitions, and by other is still 2FA, as passkeys aren't considered 2FA by many).

Google's articles

https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/

https://workspaceupdates.googleblog.com/2023/06/passkey-open-beta.html

Other articles

https://arstechnica.com/information-technology/2023/05/passwordless-google-accounts-are-easier-and-more-secure-than-passwords-heres-why/

Re: Passkeys for Google Workspace accounts - are you in or are you out?

sundermannc — Thu, 15 Jun 2023 14:10:27 GMT

I'll be honest. I'm not a fan of this passkey thing.

I understand the underlying security and why it's better. However, as I've used this on my personal account, I find it less convenient because I have to get my phone out each time. I use LastPass as my password manager, so I find it more convenient to use a password. 2SV is on of course, but that's not needed each time.

Maybe I'm missing something, but for now, I'm #TeamPassword.

#ChangeMyMind.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

alexgrutza — Thu, 15 Jun 2023 14:49:54 GMT

Because most of our users (eventually all of our users) will be behind our SSO platform, I imagine having Passkeys will not be used or applicable.

My personal experience also has not been that well done, primarily because I don't use Google Passwords nor Apples Keychain/iCloud/Password Manager either. I use Bitwarden exclusively, which will eventually be able to use Passkeys for itself. My personal situation is probably on the smaller percentile of people, but still worth noting.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

MichaelProsise — Thu, 15 Jun 2023 15:18:54 GMT

I have turned this on for about 8 people in my IT department so we can experiment with it. I feel this is the first baby step towards passwordless logins and I welcome it. Will we turn it on for everyone? I'd like to think so, but we'll see if there is any actual benefit to it.

It's difficult to say how well it will be utilized since logging in to Google is just one of may various accounts we utilize. Having a unified SSO solution would be great but for us, so far at least, it has been elusive.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Thu, 15 Jun 2023 16:57:22 GMT

LastPass... ehrm, mentioning them in the same paragraph as "security", I don't know... 🙂

Just like 1Password already has, I imagine LP will also support Passkeys soon.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Thu, 15 Jun 2023 16:58:11 GMT

I imagine that when people have become accustomed to using Passkeys for all their private accounts, it'll feel weird not being able to do it at work too.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

PieMan — Wed, 21 Jun 2023 13:01:37 GMT

I will watch this thread with interest. I haven't tested it out yet, but I will do over the summer when I have a bit more time to break stuff.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

mfoley — Wed, 21 Jun 2023 15:50:26 GMT

One thing I don't like is one password on the yubikey and that's it, So if someone gets that your into all their passkey accounts (you know how may people lose Key or leave them at their desks)

And If Google goes all passkeys I can see a problem that normal users trade in their phone or it gets damaged , and now they cant get into their account. (As they add Android phone as a passkey automatically)

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Thu, 22 Jun 2023 13:37:26 GMT

Just having the security key isn't enough to log in.

You still have to auth the key when using it, with fingerprint or face recognition, or PIN.

Since Yubikeys (most common versions) only has a simple touch area, that isn't going to be enough, you will have to create and use a PIN. That is also the default when using a Yubikey for FIDO2 stuff (not Google, which is/was U2F only).

As a 2FA device, the Yubikey (other brands may work differently) only require touch for Google accounts, but for O365 I also have to provide a PIN (touch and PIN!).

For the really security conscious, Yubico also offer Yubikeys with BIO check.

So far I'm quite happy with my regular 5-series. I have a whole bunch. I even gave one to each of my colleagues on the IT department as X-mas gifts. Got to push the envelope somehow. 🙂

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Dean_Mantz — Thu, 22 Jun 2023 15:54:14 GMT

I am planning on test-driving passkeys for my IT accounts and possibly with a small select few that I know have a solid tech foundation.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

hanker — Fri, 23 Jun 2023 14:49:16 GMT

I'm interested in Passkeys, but right now as far as I can tell on iOS the only support is through Apple's own integration which forcibly shares Passkeys over iCloud keychain. If I have a passkey I want it tied only to the devices I choose, not shared across all of them.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Sat, 24 Jun 2023 11:13:05 GMT

I agree. You should give that as feedback to Apple.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Rick2025 — Wed, 15 Nov 2023 14:26:52 GMT

Doesn't Google do the same? I think they do it in the event the device gets broken or stolen.

On Android, passkeys can be stored in the Google Password Manager, which synchronizes passkeys between the user's Android devices that are signed into the same Google account. Passkeys are securely encrypted on-device before being synced, and requires decrypting them on new devices.

Just trying to understand more on this

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Wed, 15 Nov 2023 16:19:36 GMT

I don't have more than one Android device, and it's no longer used actively, so I haven't tested Passkeys on it.

I know you can create a Passkey through Chrome that is only local to the Chrome profile, because when I removed the profile, the Passkey disappeared, but was still listed on the MyAccount page.

I had to remove it from there manually.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

kaned — Thu, 16 Nov 2023 14:16:07 GMT

I support the idea of passkeys, but in my district, I'm concerned about the Union and the use of personal devices for work related tasks.

I see adoption being thin, at least for quite some time!

Also, I use a different platform for MFA than Google, but I am listening closely on how they plan on exporting/importing passkeys from one provider to another.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Thu, 16 Nov 2023 14:50:55 GMT

You can use a Yubikey as a Passkey, and depending on your computer, you are supposed to be able to use built-in hardware features as the Passkey. As mentioned here or elsewhere, you can use TouchId on a Mac.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

kaned — Thu, 16 Nov 2023 14:56:28 GMT

We use Yubikeys for most staff now, had not heard of that... I wonder if our keys are compatible with that. I'll do more digging when I have time.

The keys we have today typically stay in the computer and would probably not be ideal/secure with our current practices...

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Kim_Nilsson — Thu, 16 Nov 2023 15:02:29 GMT

Still better for securing against external threats.

However, not (as much) for internal threats.

But, when a Yubikey is used as a Passkey, you also have to set a pin-code.

Just touching it isn't enough.

Re: Passkeys for Google Workspace accounts - are you in or are you out?

Rick2025 — Tue, 28 Nov 2023 15:59:06 GMT

I thought with passkeys especially on your personal google accounts you would also have to have a key of some kind in the event your phone breaks or gets stolen. I know you can remove passkeys if it is syncing with icloud or google, etc. And for those that don't trust the sync, what do you do now? Wouldn't you just be better off using a key? If we don't use passwords for a long time I can see people forgetting their passwords to log in and so that may create it's own issues. What would we do with people that refuse to use their personal phones for work? Would we force them down to security keys? Are we trying to pass the cost on to the users with their phones? I think we are a ways out from passkeys being anywhere close to being a standard. Many sites still don't allow for passkeys so we are back to passwords if they don't accept google sign in. Many banks are still behind the time when you look at what they use, like sms.

I am happy for all you that think that passkeys will make us more secure but I also think security keys are just as secure. The only difference is remembering password and that's only for new devices. We all know that we can sign out of past devices if you look under security right. Surely we do this in our facebook account as well..etc. Let's not forget we can also use Smartlock to use our devices for sign in as well. Have we thought how students will use this technology if they have no phone? I wish Google with personal account would allow you to change your security just for one type instead of listing sms etc. Just my thoughts

Re: Passkeys for Google Workspace accounts - are you in or are you out?

kaned — Tue, 28 Nov 2023 16:29:24 GMT

I believe @Kim_Nilsson had said that Yubikeys could be used as a passkey. Correct me if I'm wrong!

I think things will go that direction, but I do think we will have to come up with another plan (like Yubikeys) for the fraction of staff that refuse.