Comment on Passkeys Explained: The End of Passwords

• Shayeta@feddit.org ⁨23⁩ ⁨hours⁩ ago

  Cool, they know the hash to that one service I signed up with them. Not every account ever.

  source

  • Passerby6497@lemmy.world ⁨22⁩ ⁨hours⁩ ago

    Your passkeys aren’t synced to anything, so the passkey is no different than your password hash. They’re device locked unless you use something like bitwarden, so you’re no more dependent on American mega corps than you are right this second.

    source

    • kjetil@lemmy.world ⁨17⁩ ⁨hours⁩ ago

      Dont they all sync to the respective cloud services?
      iOS vault -> synced apple cloud Android vault -> synced with Google cloud?
      Windows Hello -> synced with Microsoft account?

      And if they’re not synced, that’s even worse. Loose your device and loose your account. Or keep track of which of your 5 devices are have keys for which of your 150 accounts

      source

      • Passerby6497@lemmy.world ⁨17⁩ ⁨hours⁩ ago

        Well shit, you’re right. I must not have been paying attention when they updated them to include that

        source
  • 3abas@lemmy.world ⁨18⁩ ⁨hours⁩ ago

    Say you don’t understand passkeys without saying you don’t understand them…

    A passkey uses public key cryptography to secure your account instead of a password, it only grants you access to the one account you set it up for, and the account provider only holds your public key, you control the private key. Your passkey is a secure alternative to passwords because you CANNOT reuse it across services, cannot reasonably remember it, and the method of using it isn’t by copying and pasting into a field like a password, so it isn’t susceptible to the same attacks.

    If the provider loses your public key, they can’t give you a challenge to verify you have the private key, so you lose access. Just like if they lose your password hash. It’s an identical scenario.

    source

    • kjetil@lemmy.world ⁨17⁩ ⁨hours⁩ ago

      The assumption is that the native passkey manager on the device (iPhone, android, windows) would sync the passkeys (to Apple , Google, Microsoft) for protection against device failure and easy of use across devices. Or you risk loosing your accounts if you loose your device.

      source

      • 3abas@lemmy.world ⁨17⁩ ⁨hours⁩ ago

        That would happen if you store your passwords there too…

        If you’re proactive enough with your passwords to manually store them in your own vault, you can be proactive enough to not use the corporate vaults that don’t allow exporting. This isn’t a “downside” of passkeys, it’s a downside of using the built in managers.

        source