3 ms·

sorry to be so pedantic, but passkeys is not a superset. All implementations and even the wording of the yubikeys creators say that it is the discoverable and

sorry to be so pedantic, but passkeys is not a superset. All implementations and even the wording of the yubikeys creators say that it is the discoverable and passwordless option. See [1], i have not seen counter examples where they are wrong. However, webauthn does allow for the set of options you just referenced, i.e., FIDO2 including it's backwards compat with U2F. [1]: https://developers.yubico.com/Passkeys/Passkey_concepts/Discoverable_vs_non-discoverable_credentials.html https://developers.yubico.com/Passkeys/Passkey_concepts/Disc...

FreakLegion 2y ago
Your mistake seems to be thinking that adding things to U2F credentials (here resident keys) doesn't make passkeys a superset, but that's what it does. Passkeys are U2F credentials with more stuff. The extra stuff makes passwordless possible, but whether it's allowed is up to the service. Either way, the user has a passkey. The roaming vs. platform distinction is much more arguable. Common use has "passkey" meaning "passwordless-enabled platform authenticator", but technically hardware keys also fit the bill. I stick with the common use for pragmatic reasons, but either side can well-acktshually the other all day on this one.