News for hackers. Stuff that matters.
Re:Why even let users set their own passwords? by skrebbel on Saturday July 22, 2023 @02:25PM (#36828472)
There isn't encryption involved? I mean how can you use public and private keys without encryption?

Anyways yes, I agree otherwise. That said for all intents and purposes, the private key is a password. It’s the thing you store that gives you access to the service. That it’s not transmitted, but instead the whole public key / challenge response dance is done, is IMO sufficiently well summarized as “well, it’s a special kind of autogenerated password, which can’t be insecurely transmitted or badly stored by the service”.

If we really want people to adopt passkeys we gotta begin talking about them in terms people understand. I consider myself pretty tech savvy and it took me like 6 articles until I finally grokked that a passkey is just an autogenerated password (plus some free automatic bonus security that doesn’t affect my UX)

Re:Why even let users set their own passwords? by arnarbi on Monday July 24, 2023 @03:14AM (#36844089)
> how can you use public and private keys without encryption

Signing is different from encrypting.

https://en.wikipedia.org/wiki/Digital_Signature_Algorithm

And yes, 100% agree we can do better in terms of explaining passkeys. The hardest part is that different audiences require such different approaches.