4 ms·
It's an improvement over passwords as long as two things are true: 1. Open source implementations will be indistinguishable to a 3rd party from the big tech ve
by jksflkjl3jk3 3y ago
It's an improvement over passwords as long as two things are true:
1. Open source implementations will be indistinguishable to a 3rd party from the big tech versions (so that services can't refuse to authenticate devices that haven't been locked down), and
2. The private key can be extracted from the device by the user and backed up.
- growse 3y agoWhy is #2 important? Passkeys break the 1:1 relationship between credentials and accounts, so just register multiple passkeys. If it can be extracted, it can be stolen. Better to stick your secret material in a HSM that takes the key with it when it dies.