Jeff Johnson: "Passkeys are a lie and contradiction."

Re:Jeff Johnson: "Passkeys are a lie and contradiction." by tfehring on Tuesday October 10, 2023 @09:55PM (#37840071)

> The only way to avoid vendor lock in is to allow passkeys to be persisted unencrypted.

Is this true? Naively I’d expect there to be a two-key solution that would allow Vendor A to transfer passkeys to Vendor B without requiring them to be stored unencrypted. Is the issue just that the two vendors have to trust each other (as opposed to just both being trusted by the user) for that to work?

[ Parent | on HN ]

Re:Jeff Johnson: "Passkeys are a lie and contradiction." by lapcat on Tuesday October 10, 2023 @10:24PM (#37840203)

> Naively I’d expect there to be a two-key solution that would allow Vendor A to transfer passkeys to Vendor B without requiring them to be stored unencrypted.

That's actually the kind of implementation I expect them to produce.

> Is the issue just that the two vendors have to trust each other (as opposed to just both being trusted by the user) for that to work?

I think the issue is that neither of the vendors trust the user.

They'll probably devise an exclusive (i.e., monopolistic) list of trusted vendors.

[ Parent | on HN ]