3 ms·

So this really isn't just an updated SSO implementation its an entirely different mechanism. I did not realize that. I am a bit worried that the standards and

So this really isn't just an updated SSO implementation its an entirely different mechanism. I did not realize that. I am a bit worried that the standards and ability to move around is not just part of the implantation right out the gate. I do worry what this will mean for the more average user, this is a major shift in how things work.

AviationAtom 3y ago
Correct. Nothing is centralized about Passkey (other than where you may choose to store your authenticators). Each site gets a unique keypair. If your keypair is compromised you can delete it on that given site. Passkeys is more or less just a more convenient implementation of FIDO2 or the like, as you'd traditionally have with a Yubikey token. Instead you move it to a supported password manager or mobile device. If you want to try it out go to https://passkeys.io https://passkeys.io on your Android or iOS device. I do believe Passage is more or less what Passkeys is/already was.
ecesena 3y ago
It’s not really a new standard, it’s FIDO2, it’s been around for a while using security keys (yubikeys, solokeys…). Passkeys used to be called non-resident keys. In the world of hardware security keys there was no backup/share of private keys. In this new wave of software authenticators (typically backed by the hw coprocessor that’s now available in phones & laptops), they called them passkeys, added sharing across devices, and a few debatable features like interactions with servers that may lead to lock in/tracking/etc (or may not).