4 ms·
https://passkeys.directory/ https://passkeys.directory/ indicates that plenty of relying parties have implemented support for passkeys and I’ve yet to hear abou
by dcow 2y ago
https://passkeys.directory/ https://passkeys.directory/ indicates that plenty of relying parties have implemented support for passkeys and I’ve yet to hear about any efforts taking 100 sprints (if TFA is to be believed that it’s 100x harder than a single sprint’s worth of work). Indeed a rather lazy exaggeration.
- 1oooqooq 2y ago> have implemented support for passkeys Why do you assume they have also implemented correctly for all cases?
- p0seidon 2y agoOur blog is full of examples of implementation analysis, and we have not encountered one implementation that is bug-free or leverages the complete toolset (same for us: we have just identified a bug in our implementation that relates to WebKit's user-gesture requirements on iOS versions before 17.4). That's not because of them being sloppy, it's just very difficult to get it right; that's exactly the point. For example, Uber and Amazon both did not get it right (until today). Of course, it is possible to implement passkeys without any external resources, and to be honest, we appreciate any effort, be it open-source, tutorials, or commercial applications. If you have been on an authentication team in a big B2C company and truly want to retain the trust of your customers, then you appreciate passkeys immediately as they solve one of the biggest problems... So we are also happy to see a half-good implementation as it improves security.
- 1oooqooq 2y agois it honestly better than TOTP in terms of security, ease of implementing "correctly*, and convenience?