3 ms·

> I will probably use passwords until I am forcibly unable to. I'm happy with my password manager. A random password stored in a password manager is literally

by izacus 4y ago

> I will probably use passwords until I am forcibly unable to. I'm happy with my password manager. A random password stored in a password manager is literally what a passkey is. Several password managers have announced support for storing passkeys just like your passwords.

arcanemachiner 4y ago
I've been keeping track of this GitHub issue to follow the progress of getting the feature in FOSS password managers: https://github.com/keepassxreboot/keepassxc/issues/8214 https://github.com/keepassxreboot/keepassxc/issues/8214 It appears that we are still in the "walled garden bullshit" phase, so I'll pass for now.
Biganon 4y ago
I don't understand your last sentence. If a random password stored in a password manager is a passkey, then all providers already support them
- jjnoakes 4y ago
  Passkey is about the random password stored in the password manager AND the protocol between the browser and the password manager to ensure the password isn't phished. It is the protocol that needs implementation.
Renevith 4y ago
"A random password stored in a password manager is literally what a passkey is." This is not quite true; a passkey is still somewhat more secure than a password in this scenario. With passwords, the password itself is sent to the website and a hashed version is stored in their database. If someone can intercept your connection to the site (MitM) or can access their database (hacker), they might be able to get your password and log in as you, especially if the website doesn't implement their hashing very well. These attack vectors don't apply to passkeys, even generated and synced by a software password manager: the private key never leaves your computer, only the corresponding pubic key. The website generates a unique challenge on each login that can only be solved by your private key, so intercepting a particular challenge or stealing the public key from the website database doesn't let anyone log in as you later.

by izacus 4y ago

arcanemachiner 4y ago

I've been keeping track of this GitHub issue to follow the progress of getting the feature in FOSS password managers: https://github.com/keepassxreboot/keepassxc/issues/8214 https://github.com/keepassxreboot/keepassxc/issues/8214 It appears that we are still in the "walled garden bullshit" phase, so I'll pass for now.

Biganon 4y ago

I don't understand your last sentence. If a random password stored in a password manager is a passkey, then all providers already support them

jjnoakes 4y ago
Passkey is about the random password stored in the password manager AND the protocol between the browser and the password manager to ensure the password isn't phished. It is the protocol that needs implementation.

Renevith 4y ago

"A random password stored in a password manager is literally what a passkey is." This is not quite true; a passkey is still somewhat more secure than a password in this scenario. With passwords, the password itself is sent to the website and a hashed version is stored in their database. If someone can intercept your connection to the site (MitM) or can access their database (hacker), they might be able to get your password and log in as you, especially if the website doesn't implement their hashing very well. These attack vectors don't apply to passkeys, even generated and synced by a software password manager: the private key never leaves your computer, only the corresponding pubic key. The website generates a unique challenge on each login that can only be solved by your private key, so intercepting a particular challenge or stealing the public key from the website database doesn't let anyone log in as you later.