4 ms·

Passkeys are fantastic! I recently had to use somebody else's computer to access my Google Mail account. I was able to login securely, without typing my passw

by eddyg 2y ago

Passkeys are fantastic! I recently had to use somebody else's computer to access my Google Mail account. I was able to login securely, without typing my password into the untrusted computer, by selecting "Try another way", then "Use your passkey". I scanned the QR code with my phone's Camera app, I tapped "Use passkey", my phone used Face ID to verify it was me, and then attested to Google that it was me logging in via an automatically-established Bluetooth connection between my phone and the browser. It was GREAT, and way better than typing in my password (no worry about keyloggers) and having to do a 2FA dance.

drdaeman 2y ago
The problem is, it's NOT mandatory in the spec, not even properly encouraged, and even the official demo at https://webauthn.io/ https://webauthn.io/ (and unofficial demos linked from passkeys.dev, like https://www.passkeys.io/ https://www.passkeys.io/, https://passkeys.guru/ https://passkeys.guru/ or https://passkey.org/ https://passkey.org/) do NOT have anything like that.
- eddyg 2y ago
  Because websites don’t have to worry about it or do anything “special”. It’s built-in to how to passkeys work. https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios https://support.apple.com/guide/iphone/use-passkeys-to-sign-... https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-sign-in-passkey-authenticator https://learn.microsoft.com/en-us/entra/identity/authenticat... https://support.google.com/chrome/answer/13168025 https://support.google.com/chrome/answer/13168025 https://support.apple.com/guide/mac-help/create-a-passkey-mchl4af65d1a/mac https://support.apple.com/guide/mac-help/create-a-passkey-mc...
  - drdaeman 2y ago
    Weird that you say it’s built in, because I specifically checked and I didn’t see that option anywhere. I’m using 1Password on GNU/Linux with Firefox. And I don’t think I saw it in a spec as an actual requirement for compliant implementations.

by eddyg 2y ago

drdaeman 2y ago

The problem is, it's NOT mandatory in the spec, not even properly encouraged, and even the official demo at https://webauthn.io/ https://webauthn.io/ (and unofficial demos linked from passkeys.dev, like https://www.passkeys.io/ https://www.passkeys.io/, https://passkeys.guru/ https://passkeys.guru/ or https://passkey.org/ https://passkey.org/) do NOT have anything like that.

eddyg 2y ago
Because websites don’t have to worry about it or do anything “special”. It’s built-in to how to passkeys work. https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios https://support.apple.com/guide/iphone/use-passkeys-to-sign-... https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-sign-in-passkey-authenticator https://learn.microsoft.com/en-us/entra/identity/authenticat... https://support.google.com/chrome/answer/13168025 https://support.google.com/chrome/answer/13168025 https://support.apple.com/guide/mac-help/create-a-passkey-mchl4af65d1a/mac https://support.apple.com/guide/mac-help/create-a-passkey-mc...
- drdaeman 2y ago
  Weird that you say it’s built in, because I specifically checked and I didn’t see that option anywhere. I’m using 1Password on GNU/Linux with Firefox. And I don’t think I saw it in a spec as an actual requirement for compliant implementations.