4 ms·

They will turn our security keys into junk: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/ https://fy.blackhats.net

• snuxoll 3y ago
  Personally I think the rk requirement is just fine, the long-tail goal of Passkeys is to simply credential management for users and the UX of key wrapping stands in opposition of that. Having a security key handle unlocking your platform authenticator/password manager seems to be the middle ground that's being driven towards, and as somebody with multiple YubiKey's I'm perfectly fine with it.
• microtonal 3y ago
  At the risk of setting up a straw man (but the sentiment of your comment seems negative), but should we slow down improved security for the for the whole population, so that a bunch of tech people who have hardware keys with a measly 20 or 32 slots can keep using them? Sure, authentication could also be done without resident keys, but resident keys simplify the authentication workflow a lot, since the relying party doesn't need some additional credentials to send the correct wrapped key. (Disclaimer: I have several Yubikeys.)
• yencabulator 3y ago
  Interestingly, this link says > [The definition "passkey is a resident key"] has become so invasive that even FIDO now use it as their definition. but the linked FAQ for "their definition" doesn't contain the word "resident" (anymore?).