I think they mean via the system keychain? Chrome seems to auto handle passkey requests for Google themselves.
Re:GitHub Introduces Passkey Support
by thepaulmcbride on Friday July 14, 2023 @04:44AM
(#36721129)
I thinks the idea is that it has two factors built in. The password/pin is something you know. You still have to use it on a specific device though, which is the something you have.
It is preventing password reuse and ensuring key complexity.
The implementation of the credentials manager on the device storing the passkey should also ensure 2factor auth for use of the key.
Further passkeys are highly phishing resistant since they are bound to one specific domain and the passkey manager enforces that it is only transmitted to said domain.
It is basically a phishing , credentials stuffing, brute force resistant password that should ensure 2factor authentication.
It is pretty much the spot between dedicated hardware keys and still usable for the normal guy.
The only thing I dislike is that every provider can lock you in their "passkey ecosystem" since they only sync between them etc.
> Your device supports passkeys, a password replacement that validates your identity using touch, facial recognition, a password, or a PIN.
> Your device supports passkeys, a password replacement that validates your identity using [...] a password
What is being accomplished here if I choose to activate a "passkey" using a "password" for GitHub?