4 ms·

Couldn't passkey fingerprints be used to identify you, regardless of login?

• g_p 4y ago
  Not generally, although precisely how this works in a passkey world remains to be seen. In the underlying webauthn technology, a non-resident key is uniquely generated for every account you have. In theory your use of the same token for multiple accounts on a platform isn't detectable by the provider (assuming you have good opsec around use of IPs and session isolation). There is one super targeted attack a rogue site could do - it could serve up another account's challenge, which it suspects to be you, and see if your device returns a valid webauthn response for it. Passkeys should be slightly better than this in theory - as they let you select a stored identity to authenticate as. The crux will be how Google and Apple implement this - and whether this holds true or not in their ecosystems. There's no reason it shouldn't.