4 ms·

Why not call passwords private words? We've been using words even longer. The answer is that they're being used to pass an authentication challenge. Pass + key

Why not call passwords private words? We've been using words even longer. The answer is that they're being used to pass an authentication challenge. Pass + key is no different.

__MatrixMan__ 3y ago
There's already nomenclature for that too. Auth keys vs signing keys.
- Zetice 3y ago
  I think the real answer to your question is a) marketing and b) it’s more data than just a private key. It has a private key, but also some other things. Could be clearer for the tech folks though I agree.
mr_toad 3y ago
I guess because historically (before computers) passwords were often shared. Even now a password doesn’t technically need to be private.
- bqmjjx0kac 3y ago
  "Open sesame"
- 0xCMP 3y ago
  Neither does a passkey. They've designed the standard to allow sharing the passkey with others.
  - JohnFen 3y ago
    Wait, they have?
  - CydeWeys 3y ago
    Are you sure you have the details correct here? This is not generally how public key cryptography works.
    - 0xCMP 3y ago
      For instance, with Apple you can AirDrop the Passkeys. https://support.apple.com/guide/iphone/share-passkeys-passwords-securely-airdrop-iph0dd1796bb/ios#iph461474bab https://support.apple.com/guide/iphone/share-passkeys-passwo...
    - jephdo 3y ago
      I think he might be referring to single device vs multi device pass keys https://developers.yubico.com/Passkeys/Passkey_concepts/Single_device_vs_multi_device_credentials.html https://developers.yubico.com/Passkeys/Passkey_concepts/Sing... I wouldn't be surprised if password managers implement sharing between users tho
romwell 3y ago
>Why not call passwords private words? Because the word "password" has been in use for a long time, before computers, for the purpose of physically passing from one place to another. The thing about password wasn't that it is a secret word, it's that it allows you to pass somewhere. Typically, passwords were a shared secret (i.e. not secret). A digital key is typically different from a password in that it's not a word, i.e. not something people can remember a type. It's more like something you have than something you know. In the context of cryptography it makes sense to distinguish keys from passwords, and public keys (used to "lock" data) from private keys (to "unlock" data). The word key is used for that concept because of the semantics of how keys are used. A passkey is an abomination. A key, a-priori, is an object that opens locks; and we already have words for keys that allows you to pass somewhere: e.g. door keys. A pass, in general, is something you present to pass somewhere, whether it's spoken or written; a key is not something you present to pass somewhere. We have pass words, pass slips, hall/press/ski pass badges, etc. We don't have pass keys, because you don't show a key to pass somewhere. You use it. A password encoded as a QR code that you could show to a sensor would be a passkey. Whatever Google has is probably something else.

Why not call passwords private words? We've been using words even longer. The answer is that they're being used to pass an authentication challenge. Pass + key is no different.

__MatrixMan__ 3y ago

There's already nomenclature for that too. Auth keys vs signing keys.

Zetice 3y ago
I think the real answer to your question is a) marketing and b) it’s more data than just a private key. It has a private key, but also some other things. Could be clearer for the tech folks though I agree.

mr_toad 3y ago

I guess because historically (before computers) passwords were often shared. Even now a password doesn’t technically need to be private.

bqmjjx0kac 3y ago
"Open sesame"
0xCMP 3y ago
Neither does a passkey. They've designed the standard to allow sharing the passkey with others.
- JohnFen 3y ago
  Wait, they have?
- CydeWeys 3y ago
  Are you sure you have the details correct here? This is not generally how public key cryptography works.
  - 0xCMP 3y ago
    For instance, with Apple you can AirDrop the Passkeys. https://support.apple.com/guide/iphone/share-passkeys-passwords-securely-airdrop-iph0dd1796bb/ios#iph461474bab https://support.apple.com/guide/iphone/share-passkeys-passwo...
  - jephdo 3y ago
    I think he might be referring to single device vs multi device pass keys https://developers.yubico.com/Passkeys/Passkey_concepts/Single_device_vs_multi_device_credentials.html https://developers.yubico.com/Passkeys/Passkey_concepts/Sing... I wouldn't be surprised if password managers implement sharing between users tho

romwell 3y ago

>Why not call passwords private words? Because the word "password" has been in use for a long time, before computers, for the purpose of physically passing from one place to another. The thing about password wasn't that it is a secret word, it's that it allows you to pass somewhere. Typically, passwords were a shared secret (i.e. not secret). A digital key is typically different from a password in that it's not a word, i.e. not something people can remember a type. It's more like something you have than something you know. In the context of cryptography it makes sense to distinguish keys from passwords, and public keys (used to "lock" data) from private keys (to "unlock" data). The word key is used for that concept because of the semantics of how keys are used. A passkey is an abomination. A key, a-priori, is an object that opens locks; and we already have words for keys that allows you to pass somewhere: e.g. door keys. A pass, in general, is something you present to pass somewhere, whether it's spoken or written; a key is not something you present to pass somewhere. We have pass words, pass slips, hall/press/ski pass badges, etc. We don't have pass keys, because you don't show a key to pass somewhere. You use it. A password encoded as a QR code that you could show to a sensor would be a passkey. Whatever Google has is probably something else.