3 ms·

Also, haven’t people been going on for years about how biometrics are _not_ passwords? I would personally feel far less secure replacing my master password wit

Also, haven’t people been going on for years about how biometrics are _not_ passwords? I would personally feel far less secure replacing my master password with a passkey, especially if the biometric is fingerprint. But I guess this increases security for the vast majority of people while decreasing security for a small minority. Which is probably still an overall win. I’ll continue using a strong master password for as long as it’s possible.

tadfisher 4y ago
Passkeys are tokens that have nothing to do with your biometric data. When you "unlock" a passkey on a smartphone, you are granting access to decrypt the token using a secure element coprocessor. Your biometric data is not the passkey, is only used for local authentication, and does not leave the device.
- shortcake27 4y ago
  > Passkeys are tokens that have nothing to do with your biometric data. Did you read the linked article? 1Password is allowing users to avoid having a master password at all, instead allowing them to use only biometrics to access their vaults. So this specific implementation that we're talking about right now very much has something to do with biometrics. > Your biometric data is not the passkey. Never said it was. > is only used for local authentication, and does not leave the device. Not my concern. My concern is that my biometric data is public. The same fingerprint that would unlock my phone/laptop also happens to be plastered all over said devices as well as everything else I touch. Plenty of videos on YouTube where people have lifted fingerprints and unlocked devices. Most facial recognition technologies can be fooled with a photo. I have a serious issue with someone being able to access my 1Password vault without needing a secret such as a password that only I know. FaceID is probably the only technology I'd trust to prevent unauthorised access, but as the parent mentioned, biometrics are a bit of a grey area - in certain countries / jurisdictions you can be forced to unlock a device using biometrics even if it's illegal to force a password out of you.

tadfisher 4y ago

Passkeys are tokens that have nothing to do with your biometric data. When you "unlock" a passkey on a smartphone, you are granting access to decrypt the token using a secure element coprocessor. Your biometric data is not the passkey, is only used for local authentication, and does not leave the device.

shortcake27 4y ago
> Passkeys are tokens that have nothing to do with your biometric data. Did you read the linked article? 1Password is allowing users to avoid having a master password at all, instead allowing them to use only biometrics to access their vaults. So this specific implementation that we're talking about right now very much has something to do with biometrics. > Your biometric data is not the passkey. Never said it was. > is only used for local authentication, and does not leave the device. Not my concern. My concern is that my biometric data is public. The same fingerprint that would unlock my phone/laptop also happens to be plastered all over said devices as well as everything else I touch. Plenty of videos on YouTube where people have lifted fingerprints and unlocked devices. Most facial recognition technologies can be fooled with a photo. I have a serious issue with someone being able to access my 1Password vault without needing a secret such as a password that only I know. FaceID is probably the only technology I'd trust to prevent unauthorised access, but as the parent mentioned, biometrics are a bit of a grey area - in certain countries / jurisdictions you can be forced to unlock a device using biometrics even if it's illegal to force a password out of you.