A new login technique is becoming available in 2023: the passkey. The passkey promises to solve phishing and prevent password reuse. But lots of smart and security-oriented folks are confused about what exactly a passkey is. There’s a good reason for that. A passkey is in some sense one of two (or three) different things, depending on how it’s stored.
  • skillful_garbage@beehaw.org
    15·
    1 year ago

    Passkeys are asymmetric, meaning that the server only ever sees your public key. If the server gets breached, then only your public key is leaked, which isn’t a big deal. Functionally, it’s almost identical to SSH keys.

    • lud
      3·
      1 year ago

      Since you should use a password manager anyways, it wouldn’t make a difference if they get a randomised password or public key.

      • lemmyvore@feddit.nlEnglish
        9·
        1 year ago

        If they get your password they can impersonate you to the server. They can’t do that with just the public key part of your passkey.

        • lud
          23·
          1 year ago

          That’s true.

          Ideally my password should be hashed and salted anyways, so that shouldn’t make a huge difference.