4 ms·

Passkey is MFA isn’t it? Or at least, the site can demand it? You have to do the “fingerprint” or “pin” as the second factor when authenticating…

lazide 3y ago
No. It’s an authentication method, any pin or whatever you enter is you unlocking your local auth store to allow the passkey to be used. That pin or whatever is not part of the actual authentication. Someone could have an auth flow with a password + passkey + say SMS mfa if they wanted to be a jerk. Or just use a passkey.
- lll-o-lll 3y ago
  WebAuthn has the concept of “User Verification” (optional demand). https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu... Looks like multi-factor to me.
  - lazide 3y ago
    Passkey != webauthn Enjoy - https://teampassword.com/blog/passkey-vs-webauthn https://teampassword.com/blog/passkey-vs-webauthn
    - lll-o-lll 3y ago
      Or as a counterpoint: https://support.apple.com/en-au/102195#:~:text=Credential%20security,which%20uses%20public%20key%20cryptography https://support.apple.com/en-au/102195#:~:text=Credential%20.... We are now literally arguing semantics.
      - lazide 3y ago
        Webauthn == one way to use passkeys. Which as you note can also, optionally, request other information. Which isn’t passkeys. Which is nice, but doesn’t mean passkeys do. Their scope is more limited. Technically correct is the best kind of correct, no? As I noted, if someone wanted to build a more complex flow they can - but it would be more of a jerk move than anything probably.
        lll-o-lll 3y ago
        Passkey does not appear to be a well defined term - more a marketing term - but you cannot disconnect the concept from FIDO/WebAuthn. There is no way to use a “passkey” without using the WebAuthn protocol, and hence “User Verification” is an available option and hence it’s reasonable to assert that passkeys support MFA. So, if I am a site that needs additional verification (previously used MFA), I use “User Verification” == “required”. Then I know two factors “something the user has” and “something the user knows/is” has been used.
        lazide 3y ago
        Except it actually is well defined, and has a specific standard of what it actually means? https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/ But whatever.
        lll-o-lll 3y ago
        But you agree with the rest of my statement and therefore that you were in error?
        lazide 3y ago
        Hahaha, you need to learn to read man. There is literally nothing you added that wasn’t already there. So no. But you’ve been very verbose in looking like an idiot though. So have fun with that?

lazide 3y ago

No. It’s an authentication method, any pin or whatever you enter is you unlocking your local auth store to allow the passkey to be used. That pin or whatever is not part of the actual authentication. Someone could have an auth flow with a password + passkey + say SMS mfa if they wanted to be a jerk. Or just use a passkey.

lll-o-lll 3y ago
WebAuthn has the concept of “User Verification” (optional demand). https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu... Looks like multi-factor to me.
- lazide 3y ago
  Passkey != webauthn Enjoy - https://teampassword.com/blog/passkey-vs-webauthn https://teampassword.com/blog/passkey-vs-webauthn
  - lll-o-lll 3y ago
    Or as a counterpoint: https://support.apple.com/en-au/102195#:~:text=Credential%20security,which%20uses%20public%20key%20cryptography https://support.apple.com/en-au/102195#:~:text=Credential%20.... We are now literally arguing semantics.
    - lazide 3y ago
      Webauthn == one way to use passkeys. Which as you note can also, optionally, request other information. Which isn’t passkeys. Which is nice, but doesn’t mean passkeys do. Their scope is more limited. Technically correct is the best kind of correct, no? As I noted, if someone wanted to build a more complex flow they can - but it would be more of a jerk move than anything probably.
      - lll-o-lll 3y ago
        Passkey does not appear to be a well defined term - more a marketing term - but you cannot disconnect the concept from FIDO/WebAuthn. There is no way to use a “passkey” without using the WebAuthn protocol, and hence “User Verification” is an available option and hence it’s reasonable to assert that passkeys support MFA. So, if I am a site that needs additional verification (previously used MFA), I use “User Verification” == “required”. Then I know two factors “something the user has” and “something the user knows/is” has been used.
        lazide 3y ago
        Except it actually is well defined, and has a specific standard of what it actually means? https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/ But whatever.
        lll-o-lll 3y ago
        But you agree with the rest of my statement and therefore that you were in error?
        lazide 3y ago
        Hahaha, you need to learn to read man. There is literally nothing you added that wasn’t already there. So no. But you’ve been very verbose in looking like an idiot though. So have fun with that?