3 ms·
> Any passwordless FIDO credential is a passkey. Oh great. So a physical security key could be a passkey, but only if it's used as 1FA not 2FA. At the same tim
by tgsovlerkhgsel 3y ago
> Any passwordless FIDO credential is a passkey.
Oh great. So a physical security key could be a passkey, but only if it's used as 1FA not 2FA. At the same time, this weird "store key material in a device and optionally sync to the cloud" thing is called passkey, but if someone uses it as 2FA it suddenly isn't a passkey?
- hex-m 3y agoThe term is often used without a clear definition. As a passkey should be used instead of a password, it means that you need "user verification" (PIN or biometrics) to protect the access when the device is lost. The other thing is that it is more convenient to have "discoverable credentials" (a.k.a. "resident keys") so the browser can check if there are passkeys stored on your FIDO2-authenticator for a specific website. (instead of asking for a username first) Syncing is optional but if your passkey is not synced, it is usually called a "device-bound passkey" (e.g. Windows Hello).