4 ms·
Passkeys are effectively software security keys, stored in whatever keychain you're using (Chrome or iCloud Keychain or otherwise); for the major implementation
by judge2020 4y ago
Passkeys are effectively software security keys, stored in whatever keychain you're using (Chrome or iCloud Keychain or otherwise); for the major implementations you're hearing about, the goal of their implementation is improving the UX by syncing your passkeys between devices, so as long as you can access your passkey keychain, you won't have to worry about losing your security key for that website.
As for how "passwordless" plays into this, Passkeys are generally better than passwords simply because it's PGP instead of a shared secret you send to the website, so even if a website is compromised, there's effectively 0 way the compromised database will enable password stuffing attacks on other websites.
Another cool thing is QR codes via caBLE (cloud assisted BLE), you can scan a QR code on a browser (on a bluetooth-enabled computer) to have your phone connect to that computer and present its passkey to the computer, without needing to actually plug in your device to the computer. This is not strictly a passkey thing, it just aids in making them usable.
- antihero 4y agoIt’s cool but until Apple lets Firefox use said keychain I’m not going to use it.
- toomuchtodo 4y agoMost people will though, because they’re either in the Android or Apple ecosystems.
- antihero 4y agoYeah but only being about to login to something if you’re on a certain ecosystem is horrible lock in. It’s why I always choose email sign in over Apple.
- toomuchtodo 4y agoThe standard has portability mechanisms, both for ad hoc authentication across ecosystems (I logged into login.gov yesterday on Chrome browser using my iPhone passkey) as well as exporting passkeys to ecosystem independent vaulting systems. It makes sense to approach this new paradigm with a healthy dose of skepticism, but there is evidence your concerns have solutions.
- dwaite 4y agoFirefox should have a platform entitlement that lets them just delegate to Apple's implementation when available. This is I believe what they do on Windows.
- antihero 4y agoI think they need to be in the App Store for this and I’m not sure why they aren’t.