5 ms·

Is it correct that a yubikey with U2F / webauthn can be used as a passkey, it's just the physically portable kind? Isn't this just removing the password factor

• eli 3y ago
  Passkey is really just a type of webauthn. It doesn't necessarily have to remove any other factors. I think the primary goal is to replace single-factor passwords with it.
• rfoo 3y ago
  In theory, passkey replaces password. Single factor passkey is more secure than single password, and it doesn't matter where it's stored. A passkey in whatever password manager we use (KeePass etc) makes sense. Such a passkey should not replace 2FA - you'd better still have a second factor. The confusing part is Google, Apple and Microsoft implemented a hardware-secured (hardware is by default the enclave of your phone AND vendor's HSM in cloud) form of passkey, which can also serve as the second factor, replacing both password and 2FA. Some website then decided to support this type of passkey only, NOT passkey + security key, some are even deprecating security key U2F support.
• dwaite 3y ago
  The passkey terminology is describing a "primary factor" user experience, which requires certain WebAuthn features to be implemented. A U2F-only key does not have storage so it cannot implement discoverability on its own. So it won't work as a passkey. A more modern Yubikey/security key will have the storage to do discoverability, as well as user verification (via pin or possibly via biometric) which some sites might also require.