5 ms·

So passkeys are essentially like SSH keys but for web/app logins

red_admiral 3y ago
... with some of the functionality of SSH keys removed, like being able to use one key for many accounts, or many keys (on many machines) all for the same account. At least that's how I understand it.
- barryp 3y ago
  I think you're right about the first part...a passkey being tied to a single account on a single site. But not the second: on Github for example you can have multiple passkeys for the same account.
  - jasode 3y ago
    >But not the second: on Github for example you can have multiple passkeys for the same account. People mention the "only a single passkey instead of multiple passkeys" issue because they run into some websites such as PayPal that only let you add one passkey. E.g. : https://old.reddit.com/r/yubikey/comments/14h0d7y/single_key_supported_websites_problem/ https://old.reddit.com/r/yubikey/comments/14h0d7y/single_key... https://www.paypal-community.com/t5/Managing-Account-Archives/Add-Multiple-Passkeys-in-Security-Settings/td-p/3081943 https://www.paypal-community.com/t5/Managing-Account-Archive...
  - nullfield 2y ago
    But not the same ssh key on multiple accounts.
- Xelynega 3y ago
  Unless I'm missing something these are nothing like SSH keys. They would be closer to regular password auth with SSH where you store the password in a file that's only readable by SSH. SSH keys are asymmetric such that I can make a public half available publicly and then use that to generate signatures of any challenge the server sends. With passkeys either the server needs to store the value raw(making it susceptible to data breaches or malicious actors), or store the hashed value(making it impossible to do a challenge-response, and making it susceptible to MITM/replay attacks). It seems to be all the downsides of SSH keys(aka losing it having implications), with none of the upsides, plus additional downsides(hardware devices can only generate 25 unique ones instead of using 1 and sending the public to all services with confidence it hasn't exposed any private info).
  - snowwrestler 2y ago
    I think you might be missing something. https://fidoalliance.org/how-fido-works/ https://fidoalliance.org/how-fido-works/
toomuchtodo 3y ago
They are a pleasant and improved UX for the equivalent of X.509 PKI primitives. https://en.wikipedia.org/wiki/X.509 https://en.wikipedia.org/wiki/X.509
- zie 3y ago
  Well, different anyway.

... with some of the functionality of SSH keys removed, like being able to use one key for many accounts, or many keys (on many machines) all for the same account. At least that's how I understand it.

barryp 3y ago
I think you're right about the first part...a passkey being tied to a single account on a single site. But not the second: on Github for example you can have multiple passkeys for the same account.
- jasode 3y ago
  >But not the second: on Github for example you can have multiple passkeys for the same account. People mention the "only a single passkey instead of multiple passkeys" issue because they run into some websites such as PayPal that only let you add one passkey. E.g. : https://old.reddit.com/r/yubikey/comments/14h0d7y/single_key_supported_websites_problem/ https://old.reddit.com/r/yubikey/comments/14h0d7y/single_key... https://www.paypal-community.com/t5/Managing-Account-Archives/Add-Multiple-Passkeys-in-Security-Settings/td-p/3081943 https://www.paypal-community.com/t5/Managing-Account-Archive...
- nullfield 2y ago
  But not the same ssh key on multiple accounts.
Xelynega 3y ago
Unless I'm missing something these are nothing like SSH keys. They would be closer to regular password auth with SSH where you store the password in a file that's only readable by SSH. SSH keys are asymmetric such that I can make a public half available publicly and then use that to generate signatures of any challenge the server sends. With passkeys either the server needs to store the value raw(making it susceptible to data breaches or malicious actors), or store the hashed value(making it impossible to do a challenge-response, and making it susceptible to MITM/replay attacks). It seems to be all the downsides of SSH keys(aka losing it having implications), with none of the upsides, plus additional downsides(hardware devices can only generate 25 unique ones instead of using 1 and sending the public to all services with confidence it hasn't exposed any private info).
- snowwrestler 2y ago
  I think you might be missing something. https://fidoalliance.org/how-fido-works/ https://fidoalliance.org/how-fido-works/

toomuchtodo 3y ago

They are a pleasant and improved UX for the equivalent of X.509 PKI primitives. https://en.wikipedia.org/wiki/X.509 https://en.wikipedia.org/wiki/X.509

zie 3y ago
Well, different anyway.