4 ms·

Right, passkeys are basically 1) a superset (FIDO2) of U2F that includes a passwordless option, and 2) software or "platform" rather than hardware or "roaming".

Right, passkeys are basically 1) a superset (FIDO2) of U2F that includes a passwordless option, and 2) software or "platform" rather than hardware or "roaming". If akimbostrawman was knocking the passwordless part I agree. Partly for the obvious technical reasons, but also because in enterprise security 'passwordless' is being misused to market push-equivalent auth as 'phishing-resistant', and a lot of companies are falling for it. If akimbostrawman was knocking the software part I disagree, because outside of companies like Google or Palantir IT teams aren't stoked about managing hardware tokens for tens or hundreds of thousands of people. The best option is the one people will actually use, and that's going to be passkeys.

akimbostrawman 2y ago
>knocking the passwordless part yes that's what I meant. The gain in convinence does not outweigh the disadvantage in security for me.
hbogert 2y ago
sorry to be so pedantic, but passkeys is not a superset. All implementations and even the wording of the yubikeys creators say that it is the discoverable and passwordless option. See [1], i have not seen counter examples where they are wrong. However, webauthn does allow for the set of options you just referenced, i.e., FIDO2 including it's backwards compat with U2F. [1]: https://developers.yubico.com/Passkeys/Passkey_concepts/Discoverable_vs_non-discoverable_credentials.html https://developers.yubico.com/Passkeys/Passkey_concepts/Disc...
- FreakLegion 2y ago
  Your mistake seems to be thinking that adding things to U2F credentials (here resident keys) doesn't make passkeys a superset, but that's what it does. Passkeys are U2F credentials with more stuff. The extra stuff makes passwordless possible, but whether it's allowed is up to the service. Either way, the user has a passkey. The roaming vs. platform distinction is much more arguable. Common use has "passkey" meaning "passwordless-enabled platform authenticator", but technically hardware keys also fit the bill. I stick with the common use for pragmatic reasons, but either side can well-acktshually the other all day on this one.

akimbostrawman 2y ago

>knocking the passwordless part yes that's what I meant. The gain in convinence does not outweigh the disadvantage in security for me.

hbogert 2y ago

sorry to be so pedantic, but passkeys is not a superset. All implementations and even the wording of the yubikeys creators say that it is the discoverable and passwordless option. See [1], i have not seen counter examples where they are wrong. However, webauthn does allow for the set of options you just referenced, i.e., FIDO2 including it's backwards compat with U2F. [1]: https://developers.yubico.com/Passkeys/Passkey_concepts/Discoverable_vs_non-discoverable_credentials.html https://developers.yubico.com/Passkeys/Passkey_concepts/Disc...

FreakLegion 2y ago
Your mistake seems to be thinking that adding things to U2F credentials (here resident keys) doesn't make passkeys a superset, but that's what it does. Passkeys are U2F credentials with more stuff. The extra stuff makes passwordless possible, but whether it's allowed is up to the service. Either way, the user has a passkey. The roaming vs. platform distinction is much more arguable. Common use has "passkey" meaning "passwordless-enabled platform authenticator", but technically hardware keys also fit the bill. I stick with the common use for pragmatic reasons, but either side can well-acktshually the other all day on this one.