Passkeys are just passwords that require a password manager

Re:Passkeys are just passwords that require a password manager by commandersaki on Monday August 04, 2025 @07:20PM (#44792469)

A passkey manager is morally required to do an extra factor of authentication (e.g. fingerprint, Face ID, hardware keys, etc.) when you login, but the site/app has no way of knowing/proving whether that happened; they just get the password.

Thought sites can request hardware attested passkeys? In this case usb keyfob, or passkeys instanced from a secure enclave, etc.?

[ Parent | on HN ]

Re:Passkeys are just passwords that require a password manager by Garrrrrr on Monday August 04, 2025 @09:36PM (#44793402)

stuff like this makes me wish Firefox supported serial communication like Chrome does :/. I haven't run into this since I don't have a hardware passkey, but the Circuit Python website makes it super easy to communicate and flash over serial... expect I have to use Chrome for five minutes

[ Parent | on HN ]

Re:Passkeys are just passwords that require a password manager by drdaeman on Monday August 04, 2025 @10:19PM (#44793664)

For DIY interaction with USB Webauthn/Passkey hardware tokens, you don't want serial (USB CDC), you want USB HID protocol. Those are two different things.

This was briefly possible with WebUSB, but all mainstream browser vendors have a stoplist of certain USB devices for security reasons.

[ Parent | on HN ]

Re:Passkeys are just passwords that require a password manager by tacticus on Monday August 04, 2025 @11:10PM (#44793934)

Just don't use that on windows with how they have broken most real hardware tokens with their bluetooth nonsense.

[ Parent | on HN ]