News for hackers. Stuff that matters.
Re:Passkeys: The Beginning of the End of the Password by scott00 on Thursday May 04, 2023 @08:51PM (#35824060)
I think you're right about discoverability being a key property differentiating Passkeys from WebAuthn credentials, I got that one wrong. I think the other ones would be it's likely syncable across devices, and likely requires some type of user verification.

You're probably right that if an authenticator is supporting discoverability it no longer makes sense to store the encrypted private key with the RP. It's still allowable though[0].

[0] https://www.w3.org/TR/webauthn/#credential-id

There are no comments on this comment yet.