4 ms·
> what benefits a passkey has over using a password+TOPT/HOTP 2 factor The benefit is that you don't need to remember different password for each site. However
by codedokode 4y ago
> what benefits a passkey has over using a password+TOPT/HOTP 2 factor
The benefit is that you don't need to remember different password for each site. However, it seems that passkeys are not secure, can be stolen by an attacker with root access or silently decrypted by Google. The better solution is hardware keys independent from Google.
- knaik94 4y agoI think passkeys can not be stolen for the same reason jailbreak a phone doesn't allow a user to access to extract touch-id data. For the same reason Google also can't access that information. But I don't see how the current concerns regarding pass+TOTP are mitigated without completely removing the ability to use a password+totp as a fallback. And if it is kept as a fallback, what do passkeys accomplish other than making your phone a bigger point of failure?
- codedokode 4y ago> I think passkeys can not be stolen for the same reason jailbreak a phone doesn't allow a user to access to extract touch-id data. For the same reason Google also can't access that information. Google allows exporting keys to Google cloud and importing them onto another device. This means that keys can be exported from secure storage, and if Google can do that then an attacker also can. Google claims, that PIN code or unlock pattern might be required to recover keys from cloud backup, but those are easy to bruteforce. This is not real hardware key that doesn't allow exporting private keys.