News for hackers. Stuff that matters.
Re:Passkeys: The Beginning of the End of the Password by __MatrixMan__ on Wednesday May 03, 2023 @06:06PM (#35808428)
Why not call it a private key then, we've been handling those since the 70's.

They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.

Re:Passkeys: The Beginning of the End of the Password by esquivalience on Wednesday May 03, 2023 @06:45PM (#35808839)
Why not call passwords private words? We've been using words even longer.

The answer is that they're being used to pass an authentication challenge. Pass + key is no different.

Re:Passkeys: The Beginning of the End of the Password by mr_toad on Wednesday May 03, 2023 @07:39PM (#35809337)
I guess because historically (before computers) passwords were often shared. Even now a password doesn’t technically need to be private.
Re:Passkeys: The Beginning of the End of the Password by bqmjjx0kac on Wednesday May 03, 2023 @10:35PM (#35810593)
"Open sesame"
Re:Passkeys: The Beginning of the End of the Password by 0xCMP on Wednesday May 03, 2023 @11:09PM (#35810784)
Neither does a passkey. They've designed the standard to allow sharing the passkey with others.
Re:Passkeys: The Beginning of the End of the Password by JohnFen on Thursday May 04, 2023 @11:50AM (#35817358)
Wait, they have?
Re:Passkeys: The Beginning of the End of the Password by CydeWeys on Thursday May 04, 2023 @12:49PM (#35818419)
Are you sure you have the details correct here? This is not generally how public key cryptography works.
Re:Passkeys: The Beginning of the End of the Password by jephdo on Thursday May 04, 2023 @01:12PM (#35818805)
I think he might be referring to single device vs multi device pass keys

https://developers.yubico.com/Passkeys/Passkey_concepts/Sing...

I wouldn't be surprised if password managers implement sharing between users tho

Re:Passkeys: The Beginning of the End of the Password by 0xCMP on Monday May 08, 2023 @11:26PM (#35869843)
For instance, with Apple you can AirDrop the Passkeys. https://support.apple.com/guide/iphone/share-passkeys-passwo...
Re:Passkeys: The Beginning of the End of the Password by __MatrixMan__ on Wednesday May 03, 2023 @07:02PM (#35809003)
There's already nomenclature for that too. Auth keys vs signing keys.
Re:Passkeys: The Beginning of the End of the Password by Zetice on Wednesday May 03, 2023 @10:30PM (#35810565)
I think the real answer to your question is a) marketing and b) it’s more data than just a private key. It has a private key, but also some other things.

Could be clearer for the tech folks though I agree.

Re:Passkeys: The Beginning of the End of the Password by romwell on Wednesday May 03, 2023 @09:19PM (#35810095)
>Why not call passwords private words?

Because the word "password" has been in use for a long time, before computers, for the purpose of physically passing from one place to another.

The thing about password wasn't that it is a secret word, it's that it allows you to pass somewhere. Typically, passwords were a shared secret (i.e. not secret).

A digital key is typically different from a password in that it's not a word, i.e. not something people can remember a type. It's more like something you have than something you know.

In the context of cryptography it makes sense to distinguish keys from passwords, and public keys (used to "lock" data) from private keys (to "unlock" data). The word key is used for that concept because of the semantics of how keys are used.

A passkey is an abomination. A key, a-priori, is an object that opens locks; and we already have words for keys that allows you to pass somewhere: e.g. door keys.

A pass, in general, is something you present to pass somewhere, whether it's spoken or written; a key is not something you present to pass somewhere.

We have pass words, pass slips, hall/press/ski pass badges, etc.

We don't have pass keys, because you don't show a key to pass somewhere. You use it.

A password encoded as a QR code that you could show to a sensor would be a passkey.

Whatever Google has is probably something else.

Re:Passkeys: The Beginning of the End of the Password by pimlottc on Wednesday May 03, 2023 @07:00PM (#35808987)
Given how poorly private keys have done in the end user marketplace so far, they definitely need to be rebranded.
Re:Passkeys: The Beginning of the End of the Password by __MatrixMan__ on Wednesday May 03, 2023 @07:07PM (#35809044)
Every time I notice a rebranding I assume they're trying to hide something from me. Maybe that's just me.
Re:Passkeys: The Beginning of the End of the Password by krageon on Thursday May 04, 2023 @05:05AM (#35812905)
It is a fair assumption even in this case, the rebranding serves to hide the fact that private keys are used from you.
Re:Passkeys: The Beginning of the End of the Password by dwaite on Wednesday May 03, 2023 @09:00PM (#35809955)
It isn't (just) a private key. It is part of a purpose-built authentication process that leverages private keys as a component.

You cannot use the private key within a passkey for general purpose data signing, for example.

Re:Passkeys: The Beginning of the End of the Password by Spivak on Thursday May 04, 2023 @08:32AM (#35814262)
What's stopping you? I have no intention of ever locking my keys in a hardware vault away from my own access and they're plain ole keys underneath.
Re:Passkeys: The Beginning of the End of the Password by witheld on Thursday May 04, 2023 @01:09PM (#35818753)
Then you can’t use passkeys!
Re:Passkeys: The Beginning of the End of the Password by pishpash on Wednesday May 03, 2023 @09:36PM (#35810223)
So like SSH keys and github keys but for everything else? Not going to solve the problem. Please give me hardware tokens, you know, actual "keys" I can physically secure.
Re:Passkeys: The Beginning of the End of the Password by masukomi on Thursday May 04, 2023 @07:32AM (#35813817)
because there's a time based hardware component to it.

this isn't just public key encryption. Think of it as a physical Yubikey but embedded in your ...whatever.

Re:Passkeys: The Beginning of the End of the Password by MyNameIsFred on Saturday May 06, 2023 @07:58PM (#35846525)
The simplified terminology is not for you or I as technologists. It is for the general consumer market. Yes, public/private key cryptography has been a thing for decades, but it has been out of reach for the consumer market. The whole passkey idea is to reduce the technical and cognitive friction to make it a viable replacement for passwords.