3 ms·
Each website gets a unique key. They are not signed or rooted in any trust. You can still pick any username you want for the account. What passkeys do is replac
by goalieca 3y ago
Each website gets a unique key. They are not signed or rooted in any trust. You can still pick any username you want for the account. What passkeys do is replace OTP and MFA. They live along SSO and do not replace it.
- anderspitman 3y agoI think the first use cases of WebAuthn were targeted at MFA, but passkeys are definitely being advertised as replacing passwords as the primary/only factor (with the caveat that you'll also be expected to perform some sort of pin/bio authentication on the local device).