5 ms·
A passkey is never a "thing you know." It is a "thing you have access to, which mostly behaves like a 'thing you have' but also your OS provider probably has it
by lukeschlather 3y ago
A passkey is never a "thing you know." It is a "thing you have access to, which mostly behaves like a 'thing you have' but also your OS provider probably has it if they want it."
- JohnFen 3y agoWell, we're deep into semantics now, but I think the passkey is "something you know". That you've chosen to offload your memory onto a device doesn't really change that. But, honestly, this is a point of little importance. Almost all of the "something you..." categories are only a rough guide, and most items can arguably fall into more than one of them.
- noman-land 3y agoAs soon as you write something down it becomes something you have.
- JohnFen 3y agoI can't argue with that at all.
- tunesmith 3y agoThat's not really deep into semantics if it's the whole point. Something you know is by definition not externalized, and thus has a different type of security.
- roundandround 3y agoIf a passkey is something you know then you are using a failed implementation. A fido/authn device is supposed to be able to attest to never having let the private key out, even with a relaxation to passkeys it should at least be sending it to another device that can attest.
- JohnFen 3y agoTrue, but I'm hoping that "failed implementation" is accepted, because the correct implementation is too burdensome for my taste.