3 ms·
It's not about security. It's about having a system for digital signatures that acts against the interests of the user.
by donmcronald 3y ago
It's not about security. It's about having a system for digital signatures that acts against the interests of the user.
- drdaeman 3y agoThe fundamental idea of using asymmetric cryptography to authenticate is good. It is time-proven, and it works in the best interests of users, simultaneously providing improved security. SSH just works (and while it typically lacks fancy UIs for key management, it's irrelevant to the core idea). The passkeys design, though, has a number of obvious deficiencies and limitations. It is drastically better than ye olde <input type="password" /> but it's not a good standard. The other alternative is SRP, but no browser vendor had bothered to do anything about this, so it remains a curiosity implemented on a couple websites (with all JS crypto gotchas, so - no good).