> anyone who has authenticated access to your device (that includes the creep that watched you access your phone in that bar before he stole it) will have full and unrestricted access to your Google passkeys and accounts on the same basis.
shrugs
I understand that this lapses certain security boundaries, but if you get my phone unlocked then it's game-over anyways. Hell, same for pretty much everything I own, regardless of the software on it. If the device is unlocked, you have guaranteed access to pretty much everything that matters. For all I know, you could have copied down my notes app with my WiFi password in it and exfiltrated my entire camera roll. You have access to Google Authenticator, my email, my phone and pretty much 90% of the data I would have otherwise wanted to hide.
It's once again this XKCD converging on every modern security model imaginable: https://xkcd.com/1200/
shrugs
I understand that this lapses certain security boundaries, but if you get my phone unlocked then it's game-over anyways. Hell, same for pretty much everything I own, regardless of the software on it. If the device is unlocked, you have guaranteed access to pretty much everything that matters. For all I know, you could have copied down my notes app with my WiFi password in it and exfiltrated my entire camera roll. You have access to Google Authenticator, my email, my phone and pretty much 90% of the data I would have otherwise wanted to hide.
It's once again this XKCD converging on every modern security model imaginable: https://xkcd.com/1200/