Breaking WebAuthn, FIDO2, and Forging Passkeys

Re:Breaking WebAuthn, FIDO2, and Forging Passkeys by darkhorn on Tuesday June 24, 2025 @12:03PM (#44367653)

What is passkey? I refuse anything that is not standardized? Aren't WebAuth or/and FIDO2 enough?

[ Parent | on HN ]

Re:Breaking WebAuthn, FIDO2, and Forging Passkeys by jeroenhd on Tuesday June 24, 2025 @12:20PM (#44367835)

Passkey is what programs aimed at people without favorite Linux distros call WebAuthn+FIDO2(+CTAP2+the rest of the stack you've probably already heard of).

[ Parent | on HN ]

Re:Breaking WebAuthn, FIDO2, and Forging Passkeys by arnarbi on Tuesday June 24, 2025 @12:29PM (#44367937)

It’s the same thing: https://fidoalliance.org/passkeys/

[ Parent | on HN ]

Re:Breaking WebAuthn, FIDO2, and Forging Passkeys by WorldMaker on Tuesday June 24, 2025 @05:20PM (#44371186)

Passkey is a "brand name" for consumers of common workflows under existing WebAuthn+FIDO2 standards. It needed a consumer-oriented brand name because FIDO2 sounds like someone was bad at naming their dog and WebAuthn looks like a cat walked on someone's keyboard. Passkey isn't that much better as a name, but it is better.

[ Parent | on HN ]