3 ms·
The private keys are encrypted when synced from one device to another. The key for this encryption seems to be a short PIN or biometrics. Is that true? If yes
by aborsy 4y ago
The private keys are encrypted when synced from one device to another. The key for this encryption seems to be a short PIN or biometrics.
Is that true?
If yes, the platform provider can easily decrypt the encrypted keys on their servers.
If not, what’s the other secret known only by the user that encrypts the passkeys in transit? I hope the option of a password is provided.
Further, a closed source unverified password manager such as the iCloud Keychain doesn’t sound a great idea. I could use passkeys in Android (and if there is no external hardware key support), but not on Apple’s platform.
- stetrain 4y agoApple supports third party password managers at the system level on iOS and as browser extensions in Safari.
- codedokode 4y ago> Is that true? It seems so. The article [1] mentions that you can copy the keys to a new device and you need only a backup stored in a Google cloud and PIN/unlock pattern which are easy to bruteforce: > In some cases, for example, when the older device was lost or damaged, users may need to recover the end-to-end encryption keys from a secure online backup. > To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys. So it means that Google and their friends from government organizations will be able to decrypt cloud backups easily. [1] https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin...