News for hackers. Stuff that matters.
Re:Google announces passwordless by default: Make the switch... by skarra on Tuesday October 10, 2023 @06:21PM (#37838462)
Did you know that Apple allows sharing passkeys via Airdrop?
Re:Google announces passwordless by default: Make the switch... by kiwijamo on Tuesday October 10, 2023 @06:55PM (#37838824)
Doesn't that give access to everything you've signed in using that passkey? Rather than e.g. Sharing the password for the family Netflix account.
Re:Google announces passwordless by default: Make the switch... by rkeene2 on Tuesday October 10, 2023 @08:38PM (#37839612)
No... A passkey is specific to a context (RP), which is why they're not stored on things like Yubikeys (which I think a lot of people in this thread are confused about -- the keying material on the Yubikey isn't enough to create the passkey).

Your Netflix passkey is not the same as your passkey to other services. It's generated as soon as you enroll the passkey with Netflix (by calling "navigator.credentials.create()") and is identified by an opaque handle and also the public key (this is important, because you never get the public key again so you must keep both of these: the ID, and the Public Key, otherwise you can't verify a challenge-response, since you're only given an ID and a Digital Signature at that point).

For a site to use a passkey it calls "navigator.credentials.get({ publicKey: { challenge: ..., rpId: "<same_id_as_used_when_creating_like_netflix.com>" }, mediation: "silent" })"

Which returns the key ID and a signed version of the challenge, or an error.

Everywhere you authenticate you have one or more keys, identified by these opaque handles which are stored in the User Agent and associated with some mechanism for performing digital signatures with that unique key. The User Agent, generally, has to store and distribute this information if you want to use the same passkey across multiple devices -- even if you're using a Yubikey (because, again, it's not storing the key being used for the digital signature, it's storing a private key which is used in the process of generating the digital signature, but not the passkey's actual private key -- i.e., the secret part of the public key generated earlier)

Re:Google announces passwordless by default: Make the switch... by xg15 on Tuesday October 10, 2023 @07:24PM (#37839073)
Can I print out the passkey as a QR code and scan it back in on a different device?
Re:Google announces passwordless by default: Make the switch... by vorpalhex on Tuesday October 10, 2023 @09:16PM (#37839842)
Only if you exchange contacts first and are ah.. in Airdrop range.

Your grandmom probably isn't gonna be airdropping a Netflix password.