News for hackers. Stuff that matters.

A comment on Microsoft Confirms Password Deletion for 1B Users. Parent comment

Re:Microsoft Confirms Password Deletion for 1B Users by samcat116 on Tuesday December 17, 2024 @03:39PM (#42445075)
Passkeys are tied to a DNS name, so unless they were able to take over the DNS of a site, they wouldn't ever even be offered to authenticate the password. Additionally the private key never leaves the device regardless, so if you were tricked to setup a new passkey on a fake site, you'd just end up creating a new Passkey for it and the site would get some new unique public key.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by bennettnate5 on Tuesday December 17, 2024 @06:33PM (#42446595)
More than DNS name though--while DNS is susceptible to MITM and cache poisoning, afaik passkeys requires HTTPS so the domain's certificate is validated. Authentication not assertion and all that
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by GoblinSlayer on Wednesday December 18, 2024 @02:55AM (#42448799)
pwdhash does that for passwords - binds them to DNS name.
[ Parent | on HN ]