GitHub Passkeys are generally available

Re:GitHub Passkeys are generally available by jopsen on Monday September 25, 2023 @02:34PM (#37648495)

> I'll just start storing passkeys in my password manager instead of passwords wherever possible

Depends on how the password manager stores the passkeys.

I noticed that bitwarden stores TOTP keys such that the secret is exportable. Which means that if you're bitwarden wallet is compromised, even temporarily, the TOTP keys can be stolen.

If the password manager just stores the private key as an encrypted file, then it would probably be better to use a yubikey, iOS or Android device as those are designed to prevent the key from being extractable.

But maybe password managers will store passkeys a HSM.

[ Parent | on HN ]

Re:GitHub Passkeys are generally available by Ajedi32 on Monday September 25, 2023 @02:47PM (#37648675)

I don't plan on using an HSM to store my passkeys anytime soon. The security benefits are marginal for me compared to the huge inconvenience of having to manually update my credentials on hundreds of sites every time I buy a new HSM.

I'll continue to use WebAuthn hardware keys as a second factor for the small minority of sites where that makes sense. For the rest I'll just use passkeys synced to my password manager.

[ Parent | on HN ]

Re:GitHub Passkeys are generally available by dwaite on Monday September 25, 2023 @05:48PM (#37651184)

You have a (constantly expanding) choice in what software or hardware your passkeys are provided by, and can decide based on your own risk/convenience trade-offs.

[ Parent | on HN ]