This author is astoundingly trusting.

> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?

Any of them? All of them?

"Starting next year, only Google Authenticator and Google Chome passkeys will be valid for gmail logins. Help us keep your account safe by limiting access so ONLY YOU can read your emails"

"Good news! Your Instagram account is getting safer from hackers and spammers. As of next month, you'll use your Meta Metaverse token for all logins to Instagram, Facebook, Theads and WhatsApp"

Google already forced OAuth2 on Thunderbird [0] and the rest of the email-client universe.

[0] https://support.mozilla.org/en-US/kb/automatic-conversion-go...

▲

blackcatsec 2 hours ago | parent | next [-]

Google forced OAuth2 because Simple authentication is absolutely terrible.

▲

ForHackernews 2 hours ago | parent | next [-]

There's absolutely nothing insecure or wrong with app passwords for a local client application.

The whole point of OAuth2 is to allow logging in to some untrusted 3rd party site via an authentication provider without having to key your password into the 3rd party site.

a) Local client software like Thunderbird is/must be trusted, it's not a random 3rd party website.

b) App passwords remove the risk of Thunderbird stealing your password, even if for some reason you didn't like typing a password into Thunderbird.

c) Google is both the Authentication Provider and the Resource Server in this example, so it adds zero security.

▲

leni536 2 hours ago | parent [-]

App passwords are not scoped, are they? When I set up an app password for my whole google account it is never asked whether it is for email, docs, youtube, etc... . The oauth token is properly scoped.

	▲	ForHackernews 2 hours ago \| parent [-]
		I mean... that's up to Google how they choose to implement app passwords. Back when they still supported them, I think they were properly scoped. An app password is basically just an API token, it's up to the backend what powers it grants.

▲

NoidFonsense 2 hours ago | parent | prev [-]

Whats so bad about it

▲

mixdup 2 hours ago | parent | prev [-]

Google would not do something that would lock out half of the mobile device market. iOS doesn't do attestation.

Also, is there a reason Thunderbird or other clients couldn't use OAuth? I'm fairly certain I can login to GMail on Mail.app in macOS and other clients, so they're not using that to lock people into the official app or their browser

▲

goda90 2 hours ago | parent | next [-]

Are you sure iOS doesn't do attestation? Google recently turned on requiring an iOS or Google-attested Android device with a camera for some reCAPTCHA challenges(i.e. take a photo of this QR code). They waited for Apple to support it before doing so.

	▲	mixdup 2 hours ago \| parent [-]
		Is that the same thing we're talking about here? That sounds like a CAPTCHA, not Passkeys. I mean iOS isn't doing attestation in Passkeys, I'm sure there's some thing on the phone that it's doing that is a version of attestation

▲

BizarroLand 2 hours ago | parent | prev | next [-]

Google today might not do that, but Google tomorrow, when some upper manager's multi-million dollar bonus gets tied by a performance metric on how many people are using passkeys for gmail would in a heartbeat.

▲

ForHackernews 2 hours ago | parent | prev [-]

Thunderbird is an email client, not a web browser or a web server. It had to build in support for both of those things to support oauth2 login: https://bugzilla.mozilla.org/show_bug.cgi?id=849540

I assume Mail.app had to do the same.

▲

mixdup 2 hours ago | parent [-]

Okay? At some point mail applications didn't support IMAP, because it was new. Was IMAP bad because it forced POP3 clients to build new support that they didn't previously do in order to support the improved functionality?

OAuth wasn't about lock-in (since any client can support it), it was about getting off shitty legacy auth

	▲	ForHackernews 2 hours ago \| parent [-]
		OAuth2 solves a bunch of problems that are irrelevant for a desktop email client. https://news.ycombinator.com/item?id=50089261 You shouldn't need a web browser to read email.