News for hackers. Stuff that matters.
Re:The Cryptography Behind Passkeys by drdrey on Wednesday May 14, 2025 @04:51PM (#43989080)
doesn't that mean your passkeys are now about as secure as a regular password?
Re:The Cryptography Behind Passkeys by SchemaLoad on Wednesday May 14, 2025 @06:57PM (#43990055)
No. The service you are logging in to does not hold the keys so they can't be leaked, passkeys do not get reused between services, it's effectively impossible to fall for phishing attacks with passkeys, and it's effectively impossible to fall for scammers trying to get your keys since there isn't any mechanism to directly dump the private keys out.

Pretty much all the problems related to passwords are solved by passkeys, having them synced between your devices does not impact that.

Re:The Cryptography Behind Passkeys by johnmaguire on Wednesday May 14, 2025 @05:11PM (#43989269)
Passkeys are highly phishing resistant in a way that passwords are not and are not subject to credential reuse (though password managers somewhat solve the first problem and almost entirely solve the latter problem.)

In effect, though, 1Password is both something you have (the device with 1P logged in, login requires a Security Key that you don't memorize) and something you know (the master password) or are (typically biometrics can be used to unlock for a period after entering the master password.)

Re:The Cryptography Behind Passkeys by jcattle on Thursday May 15, 2025 @02:47AM (#43992469)
How do Password managers solve phishing issues? Even just somewhat?
Re:The Cryptography Behind Passkeys by josephcsible on Thursday May 15, 2025 @02:52AM (#43992492)
Your password manager will autofill your credentials on the real site but not on a phishing site.
Re:The Cryptography Behind Passkeys by jcattle on Thursday May 15, 2025 @05:02AM (#43993143)
Ah true. Didn't think of that. Good point
Re:The Cryptography Behind Passkeys by kbolino on Wednesday May 14, 2025 @05:03PM (#43989191)
A passkey is a public-private keypair strongly tied to a specific site. Sites never have access to the private key, and the key will never be presented for use on the wrong site. Those two advantages remain even if the passkey is stored in software or synced over the cloud.
Re:The Cryptography Behind Passkeys by recursive on Wednesday May 14, 2025 @05:42PM (#43989517)
Don't know about you, but my passwords were already secure enough anyway.
Re:The Cryptography Behind Passkeys by awesome_dude on Wednesday May 14, 2025 @07:00PM (#43990072)
That's my impression as well, and the nature of computing today /encourages/ putting passkeys into some container that means that they can be accessed from other pieces of hardware at different locations.
Re:The Cryptography Behind Passkeys by loeg on Thursday May 15, 2025 @02:02AM (#43992255)
From a practical perspective, passkeys are mostly identical to passwords where (1) secret generation is guaranteed to be strong, random, and unique; (2) they're tied to a specific site, so they can't be phished; and (3) filling is standardized and therefore ergonomic. If your passwords have those properties, passkeys aren't really an improvement for you. The main benefit to savvy consumers is that websites can trust that your passkeys are actually high quality and treat them as a primary authentication mechanism, instead of only a weak factor in an MFA system. And of course the huge huge benefit to most (unsavvy) consumers is that, you know, they're actually secure/unique and phishing-resistant.
Re:The Cryptography Behind Passkeys by udev4096 on Thursday May 15, 2025 @03:21AM (#43992623)
Normal passwords can be phished, no matter how strong it is. The weak link is always a careless human. Passkeys are definitely a huge improvement for everyone, apart from the vendor-lock in which can be avoided
Re:The Cryptography Behind Passkeys by loeg on Thursday May 15, 2025 @01:43PM (#43997437)
You can get around it, of course, but password managers are aware of the correct domain for a password and will only auto fill it into a form on the right domain. This is phishing-resistant. I'm not saying it's perfect, and I'm a big passkeys advocate. But "randomly generated password auto-filled by 1password" already meets many of the same benefits as passkeys, kinda, so long as auto-fill works on that particular website. Passkeys, in addition to stronger versions of those properties, also provide (1) ergonomics/standardization ("fill" works everywhere) and (2) sites can trust them to be strong.