Re:Why are banks still getting authentication so wrong?
by kortilla on Tuesday May 13, 2025 @05:01PM
(#43977690)
One of the “features” of a passkey is that you can’t point to it. It’s a fucking nightmare
Re:Why are banks still getting authentication so wrong?
by mixmastamyk on Tuesday May 13, 2025 @06:03PM
(#43978274)
I didn't understand it either, but on the "Security Now" podcast Steve said it's basically like using a FIDO2 key but virtualized in software. As I've used a yubikey and understand public/private keys (with ssh) I now have a vague idea.
As the sibiling comment alludes, FLOSS projects have been threatened for allowing (part of?) the key to be exported!
Passkey UX is absolutely terrible. It's unclear what is happening, what is being stored where (do you have my passkey? do I? is it in my browser? is it on my phone?), how communication is happening between devices, etc. Also nobody seems to explain what exactly a passkey is. Where's the thing I can point at and say "that's your passkey"?