News for hackers. Stuff that matters.
Re:Passkeys: A Shattered Dream by gruez on Friday April 26, 2024 @08:07AM (#40168363)
>2) In the second case when one service is breached you'd still have to manage rotation of public key somehow

Why would you need to rotate your keys? If they're storing passwords/hashes it makes sense to rotate because they might be able to brute force the hashes on a GPU cluster, but you're not going to be able to brute force a randomly generated public key.

Re:Passkeys: A Shattered Dream by Twisell on Friday April 26, 2024 @09:55AM (#40169436)
If I have any fear that the associated private key have leaked. For instance if my off-site encrypted backup is stolen. I sure would want to rotate my private key because my secret would be only as safe as the encryption method at the time the backup was stolen. I'm still not entirely sold on the "quantum will break any current crypto" but better safe than sorry.
Re:Passkeys: A Shattered Dream by gruez on Friday April 26, 2024 @10:57AM (#40170202)
>If I have any fear that the associated private key have leaked. For instance if my off-site encrypted backup is stolen.

That sounds like a totally separate threat compared to "when one service is breached". In your last comment you were talking about your password manager being hacked, but in the post before that you were talking about the service (ie. the website you're using) being hacked?

Also, while I do agree that if your your password manager database were hacked you would need to rotate both passwords and passkeys, but I would hope that occurs far less frequently than some random service you use getting hacked.