Re:Passkeys now support external providers
by 9dev on Tuesday June 06, 2023 @05:34PM
(#36219389)
This is just plain wrong. The server only ever stores your public key, private keys are stored on the clients. Everything else would defeat the entire purpose.
[ Parent
| on HN ]
Re:Passkeys now support external providers
by chimpoftheages on Tuesday June 06, 2023 @05:41PM
(#36219460)
No it is technically correct for nondiscoverable mode. Naturally there should be low value in breaking the opacity of the stored key as it should be a private key only used with the server that holds it.
Re:Passkeys now support external providers
by chimpoftheages on Wednesday June 07, 2023 @05:58AM
(#36224884)
Not sure why reality is so controversial, here are references for anyone who wants to know how a (standard) unlimited fido hardware token works:
https://security.stackexchange.com/questions/237271/where-ar...
OTOH for resident keys they usually support 50-100.
Re:Passkeys now support external providers
by Dylan16807 on Tuesday June 06, 2023 @07:10PM
(#36220371)
It would not defeat the entire purpose.
"non-discoverable" WebAuthn keys aren't part of "passkeys", apparently, but they locally encrypt the per-site data, including the private key, and then give that encrypted data to the server to store.