Passkeys for Google Workspace accounts - are you in or are you out?

[Kim_Nilsson]

I feel it is a good talking point, as it will definitely be something people will be interested in using for Workspace in the very (near?) future, and admins may have to decide whether to allow it, which I absolutely recommend for all who don't force 2FA, and would probably recommend even then, as that 2FA becomes 3FA (by some definitions, and by other is still 2FA, as passkeys aren't considered 2FA by many).

Google's articles

https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/

https://workspaceupdates.googleblog.com/2023/06/passkey-open-beta.html

Other articles

https://arstechnica.com/information-technology/2023/05/passwordless-google-accounts-are-easier-and-m...

[sundermannc]

I'll be honest.  I'm not a fan of this passkey thing.

I understand the underlying security and why it's better.  However, as I've used this on my personal account, I find it less convenient because I have to get my phone out each time.  I use LastPass as my password manager, so I find it more convenient to use a password. 2SV is on of course, but that's not needed each time.

Maybe I'm missing something, but for now, I'm #TeamPassword.  

#ChangeMyMind.

[Kim_Nilsson]

LastPass... ehrm, mentioning them in the same paragraph as "security", I don't know... 🙂

Just like 1Password already has, I imagine LP will also support Passkeys soon.

[alexgrutza]

Because most of our users (eventually all of our users) will be behind our SSO platform, I imagine having Passkeys will not be used or applicable.

My personal experience also has not been that well done, primarily because I don't use Google Passwords nor Apples Keychain/iCloud/Password Manager either. I use Bitwarden exclusively, which will eventually be able to use Passkeys for itself.  My personal situation is probably on the smaller percentile of people, but still worth noting.

[Kim_Nilsson]

I imagine that when people have become accustomed to using Passkeys for all their private accounts, it'll feel weird not being able to do it at work too.

[MichaelProsise]

I have turned this on for about 8 people in my IT department so we can experiment with it.  I feel this is the first baby step towards passwordless logins and I welcome it.  Will we turn it on for everyone?  I'd like to think so, but we'll see if there is any actual benefit to it.  

It's difficult to say how well it will be utilized since logging in to Google is just one of may various accounts we utilize.  Having a unified SSO solution would be great but for us, so far at least, it has been elusive.

[PieMan]

I will watch this thread with interest. I haven't tested it out yet, but I will do over the summer when I have a bit more time to break stuff.

[mfoley]

One thing I don't like is one password on the yubikey and that's it,  So if someone gets that your into all their passkey accounts (you know how may people lose Key or leave them at their desks) 

And If Google goes all passkeys I can see a problem that normal users trade in their phone or it gets damaged , and now they cant get into their account.  (As they add Android phone as a passkey automatically)  

[Kim_Nilsson]

Just having the security key isn't enough to log in.

You still have to auth the key when using it, with fingerprint or face recognition, or PIN.

Since Yubikeys (most common versions) only has a simple touch area, that isn't going to be enough, you will have to create and use a PIN. That is also the default when using a Yubikey for FIDO2 stuff (not Google, which is/was U2F only).

As a 2FA device, the Yubikey (other brands may work differently) only require touch for Google accounts, but for O365 I also have to provide a PIN (touch and PIN!).

For the really security conscious, Yubico also offer Yubikeys with BIO check.

So far I'm quite happy with my regular 5-series. I have a whole bunch. I even gave one to each of my colleagues on the IT department as X-mas gifts. Got to push the envelope somehow. 🙂

[Dean_Mantz]

I am planning on test-driving passkeys for my IT accounts and possibly with a small select few that I know have a solid tech foundation. 

[hanker]

I'm interested in Passkeys, but right now as far as I can tell on iOS the only support is through Apple's own integration which forcibly shares Passkeys over iCloud keychain. If I have a passkey I want it tied only to the devices I choose, not shared across all of them.

[Kim_Nilsson]

I agree. You should give that as feedback to Apple.

[Rick2025]

Doesn't Google do the same? I think they do it in the event the device gets broken or stolen. 

On Android, passkeys can be stored in the Google Password Manager, which synchronizes passkeys between the user's Android devices that are signed into the same Google account. Passkeys are securely encrypted on-device before being synced, and requires decrypting them on new devices.  

Just trying to understand more on this

[Kim_Nilsson]

I don't have more than one Android device, and it's no longer used actively, so I haven't tested Passkeys on it.

I know you can create a Passkey through Chrome that is only local to the Chrome profile, because when I removed the profile, the Passkey disappeared, but was still listed on the MyAccount page.

I had to remove it from there manually.

[kaned]

I support the idea of passkeys, but in my district, I'm concerned about the Union and the use of personal devices for work related tasks.

I see adoption being thin, at least for quite some time!

Also, I use a different platform for MFA than Google, but I am listening closely on how they plan on exporting/importing passkeys from one provider to another.

[Kim_Nilsson]

You can use a Yubikey as a Passkey, and depending on your computer, you are supposed to be able to use built-in hardware features as the Passkey. As mentioned here or elsewhere, you can use TouchId on a Mac.

[kaned]

We use Yubikeys for most staff now, had not heard of that...  I wonder if our keys are compatible with that.  I'll do more digging when I have time.

The keys we have today typically stay in the computer and would probably not be ideal/secure with our current practices...

[Kim_Nilsson]

Still better for securing against external threats.

However, not (as much) for internal threats.

But, when a Yubikey is used as a Passkey, you also have to set a pin-code.

Just touching it isn't enough.

[Rick2025]

I thought with passkeys especially on your personal google accounts you would also have to have a key of some kind  in the event your phone breaks or gets stolen. I know you can remove passkeys if it is syncing with icloud  or google, etc.  And for those that don't trust the sync, what do you do now? Wouldn't you just be better off using a key?  If we don't use passwords for a long time I can see people forgetting their passwords to log in and so that may create it's own issues.   What would we do with people that refuse to use their personal phones for work?  Would we force them down to security keys?   Are we trying to pass the cost on to the users with their phones? I think we are a ways out from passkeys being anywhere close to being a standard.  Many sites still don't allow for passkeys so we are back to passwords if they don't accept google sign in.  Many banks are still behind the time when you look at what they use, like sms. 

I am happy for all you that think that passkeys will make us more secure but I also think security keys are just as secure. The only difference is remembering password and that's only for new devices.  We all know that we can sign out of past devices if you look under security right.  Surely we do this in our facebook account as well..etc. Let's not forget we can also use Smartlock to use our devices for sign in as well.   Have we thought how students will use this technology if they have no phone?   I wish Google with personal account would allow you to change your security just for one type instead of listing sms etc. Just my thoughts 

[Kim_Nilsson]

Baby steps. 🙂

No bank over here allows login/pass, nor SMS. We have either a dongle, a smartcard or most commonly a BankID mobile app (kind of like Authenticator), which you can only get from physically visiting your bank.

We are now being forced to use 2FA for our national standard testing platform, and many school districts are actually simply saying people should use their own devices, just like they'd use their own driving licence if they had to drive anywhere for work. The funny thing is that even the teacher union is agreeing with the district. Basically saying "don't make it weird - just do what is easiest". 🙂

[kaned]

I believe @Kim_Nilsson had said that Yubikeys could be used as a passkey.  Correct me if I'm wrong!

I think things will go that direction, but I do think we will have to come up with another plan (like Yubikeys) for the fraction of staff that refuse.

[Kim_Nilsson]

Yup, that's exactly what we're doing, and we are calculating only having to hand out a handful.

We're fairly sure we will even get a few back, as people realise it's so much easier using their own phone.

We're doing the same for all other county/municipality staff (outside the education department), who will need a mobile app or a Yubikey to log into their Windows 11 devices.

[Rick2025]

One thing we know for sure in education is that almost every student account does not use 2fa.  Before you can use passkeys on a apple device you have to have 2fa enabled. Apple will direct you to do that.  I know the standard is 2fa, but lots of old apple accounts and if you want there is a way to actually set up no 2fa on your apple account.  Until this use becomes more standard such as a Chromebook using a camera or finger print reader ( not a special order to do this or a high price tag) being the default to creation of example even a  google account, this will be cumbersome no matter how you look at it. For now a couple of keys is likely the best approach. Also until google decides that using your phone number is no longer acceptable to recover  a public account  your account will always be vunerable.  I agree passkeys will be the way, it is just not there yet and still has a long way before it is.  Finger print, eyescan facial recognition and maybe a drop of your blood for dna...LOL Just my thoughts You can also bet using windows or macs and maybe even a chrome device in the future someone will think of something to get around passkeys. Just because we are not there yet doesn't mean it won't happen. How many zero days alert/bugs are found? It all comes down to Code Verses Code.

[Kim_Nilsson]

Currently I see zero priority for forcing Passkeys or 2FA for students.

The negative effect of adding 2FA on student accounts greatly overshadows any security gain.

Some admins go so far as to not even allowing 2FA for (younger) students, simply because they can't manage it, and no staff has a second of free time to mess with students' 2FA. They will have enough with their own.

Older students who add 2FA on their on volition, I'm perfectly fine with that, as it is possible to remove it if they ever mess up. Yes, it's an annoying waste of time, but the older (pick whatever age you want) students are more likely to take care of it, if they are trained to do so (just like our staff needs to be)!

[Rick2025]

I agree Kim about the complexity of 2fa for students, but that is not the point I was trying to make. Passkeys is the new shiny which requires a phone or specialize hardware. 

[Kim_Nilsson]

Yes, 100%. Either modern phone or modern computer, and not even all computers, or an external hardware key. Biometrics isn't absolutely necessary, but it does make it a lot easier to use.

[Justin_W]

Agreed.

Properly working biometrics seems straightforward enough.

But even then - getting K4/K5 students enrolled and using it seems like an unnecessary burden.  Those snotty/tiny little fingers are also not great candidates for biometrics - and I'm not sure how well face scan works on someone who's face is going to change so much year after year (as they grow).

Also note: In our K-8, we don't allow students to bring/use their phones in class. So that rules that out.  We still have staff who are (understandably) resistant to using their personal cell phone as a required work tool (installing auth app / registering).  So that'd be a long discussion here too. 

[Rick2025]

This is an interesting video with Steve Gibson- https://www.youtube.com/watch?v=do1ZnKBOSP8