Re:Bitwarden developer survey: Secrets, security and the fut...
by nl on Monday October 23, 2023 @12:07AM
(#37981513)
It's amazing that this is the best explanation of passkey that exists on the web.
Re:Bitwarden developer survey: Secrets, security and the fut...
by vanilla_nut on Monday October 23, 2023 @11:09AM
(#37986742)
TIL about 3)! That's fantastic to hear. Password managers sort of do this already, though.
So if you're a competent password manager user, only 1) matters. Passkeys really do seem like a bigger deal to your average user, since 2) and 3) implicitly incorporate password best practices.
Re:Bitwarden developer survey: Secrets, security and the fut...
by effie on Tuesday October 24, 2023 @05:09PM
(#38005640)
This seems to be the description of SSH keys capabilities except the user does not control them. Why did they not just use SSH keys? They are much more familiar, and all major bugs are already squashed for years.
1. You prove you have control of a key without telling the service the content of the key (like SSH keys, and any other PK setup) so: you cannot lose your password. The private part probably never leaves your device (probably - if you use Apple or Google's implementation there's magic/low security sync, you might also manually backup the private keys to a file)
2. A new keypair is generated per service. Don't reuse your password is baked in the spec, and by using individual keypairs the service can't profile you by the public key (privacy).
3. And possibly the most important. WebAuthn (of which Passkey is a popular marketing term) includes the asking identity during the registration/signup and login/proof stages, it doesn't rely on the user inspecting the url/webpage look/auth domain. Ie. You cannot be phished by examp1e.com when connecting to example.com (much like SSH's TOFU, but sorely missing from most web interactions).