Don't use passkeys for encrypting user data

Re:Don't use passkeys for encrypting user data by lxgr on Saturday February 28, 2026 @05:09AM (#47193141)

Passkeys can absolutely constitute two factors. At least the iOS and Android default implementations back user verification (which the website/relying party can explicitly request) with biometric authentication, which together with device possession makes them two factor.

[ Parent | on HN ]

Re:Don't use passkeys for encrypting user data by FreakLegion on Saturday February 28, 2026 @06:35AM (#47193930)

That's not what two-factor means. Forget about passkeys -- if you use a password manager, and that password manager has a biometric lock, your accounts don't thereby have a biometric lock as a second factor. The transitive property doesn't apply here.

[ Parent | on HN ]

Re:Don't use passkeys for encrypting user data by lxgr on Saturday February 28, 2026 @07:29AM (#47194502)

I’d say it does apply transitively, but only if the weakest link itself is also strong enough, and passwords are not.

[ Parent | on HN ]

Re:Don't use passkeys for encrypting user data by UltraSane on Saturday February 28, 2026 @03:10PM (#47199686)

And even a passkey on a phone that doesn't require authentication is immune to remote phishing and cloning.

[ Parent | on HN ]