Re:Ask HN: WebAuthn – Replace Password or Second Factor?
by PassageNick on Monday October 17, 2022 @03:12PM
(#33238199)
WebAuthn is not at all like saving your password in your browser. Passkeys (i.e.private keys) are stored in a virtually impregnable Trusted Platform Module and not available. Even if someone steals your device, they cannot access your passkeys.
That said, the key thing to consider here is security vs ease of use. The more you opt for ease of use (like writing down your password or saving your password in your browser or WebAuthn passkey or using a password manager), the more you sacrifice security with varying degree (as the risk of password leaking increases). I'd say the proposed passkeys is definitely one of the worse option here (akin to saving your password in your browser) as anyone with access to your device will be able to access all your accounts without even needing to know your credentials.