4 ms·

Great, so we are back to passwords then

• aprilnya 2y ago
  No, because passwords are just something-you-know (one factor) while a passkey that’s protected with a password is both something-you-have and something-you-know (two factors)
  • vdfs 2y ago
    So like a password manager?
    • aprilnya 2y ago
      No, because a password manager still just stores passwords (one factor!); if someone got that password they can get in The whole point of a passkey is that it’s something you have, not know: - you can’t guess it because it’s a really long encryption key - you can’t phish it because using a passkey does not give the passkey to the site, it just proves that you have the key (typical priv/pub key auth) - you can’t steal it because passkeys are meant to never be moved from the device — it’s supposed to be impossible to extract them, as they’re supposed to live on a secure enclave type chip that is impossible to extract from So, no, not like a password manager