4 ms·

Passkeys are basically just asymmetric encryption. When you create a passkey, you upload the public key to the website, and the private key stays on your device

Passkeys are basically just asymmetric encryption. When you create a passkey, you upload the public key to the website, and the private key stays on your device. That greatly reduces your risk if/when credentials gets leaked from the site in question. Public keys are meant to be public, and worthless by themselves. As for your private key, that usually ends up in a secure enclave or similar HSM, which in turn is protected by a pin code and face or fingerprints. The private key then becomes "something you know", and your biometrics are "something you have".

pferde 1y ago
Just an almost meaningless nitpick, but biometrics are "something you are", aka. the third of the famed three factors. :)
- 8fingerlouie 1y ago
  Well, biometrics usually act as a proxy for PIN codes, so the PIN code is something you know, the private key is something you have, and biometrics is authentication. And yes, nitpicking :)
- nulbyte 1y ago
  I'll never understand this. I am not a fingerprint.
  - mzajc 1y ago
    You are a human, and humans have permanent fingerprints. The difference between "something you have" and "something you are" is that you can regenerate the former, but not the latter.
    - 8fingerlouie 1y ago
      That kinda leaves (current) biometrics in a gray zone, as fingerprints and faces can be regenerated. You literally leave your fingerprint on every surface you touch, and faces can be covertly photographed.
      - baseballdork 1y ago
        I believe they were referring to the fact that you can't hit a button and generate new fingerprints for yourself. The ones you have are with you forever, generally.
        aeonik 1y ago
        Assuming you don't get a paper cut or something.
- immibis 1y ago
  Actually, all three factors are things you know: Your password is something you know. The private key on the security processor is something you know. And your scan of your fingerprint is something you know.
ajnin 1y ago
Client certificates have existed for basically as long as encryption. Passkeys are more than that, and that is a crucial point. They allow to verify the identity of the signing device, and allow access only if the device is "legitimate" from the point of view of the remote service. That is a very big encroachment on the user's privacy and freedoms and a new very big step in the process of tying everything even more tightly to accounts and devices controlled by the big service providers and making it more difficult to get out or to enter the market for new actors. Think Trusted Computing. Soon it will be impossible to log in to some media streaming platform, for example, if you don't have a passkey sanctioned by an OS with a TPM. Then everything will be locked in and the only flaw will be our eyes and our ears.
- 8fingerlouie 1y ago
  Absolutely, passkeys couple a trusted device (typically a phone with HSM) with asymmetric encryption. HSM ensures that the device is actually the device it claims to be, as the key cannot leave the device, and by coupling it with biometrics, which is authentication, you prove to the device you are who you claim to be. So by the device authenticating you, the device by extension can authenticate you against the remote site using a cryptographic challenge. There is no vendor lock in however. You can use a password manager like 1Password to store passkeys, or even Apples keychain supports synchronizing the passkey across devices (including windows). KeepassX also supports passkeys, so it’s not limited to official vendors like TPM. As for HSM, you can also use something like a Yubikey.
- mathiaspoint 1y ago
  Oh yeah fuck off with that. I was wondering why I couldn't just use a client cert (or better yet my ssh keys) and figured it would be something like that. It turns out I was right to invest zero time or energy figuring it out.
  - 8fingerlouie 1y ago
    Passkey is literally an open standard under the FIDO alliance. https://www.yubico.com/blog/10-things-youve-been-wondering-about-fido2-webauthn-and-a-passwordless-world/ https://www.yubico.com/blog/10-things-youve-been-wondering-a...

pferde 1y ago

Just an almost meaningless nitpick, but biometrics are "something you are", aka. the third of the famed three factors. :)

8fingerlouie 1y ago
Well, biometrics usually act as a proxy for PIN codes, so the PIN code is something you know, the private key is something you have, and biometrics is authentication. And yes, nitpicking :)
nulbyte 1y ago
I'll never understand this. I am not a fingerprint.
- mzajc 1y ago
  You are a human, and humans have permanent fingerprints. The difference between "something you have" and "something you are" is that you can regenerate the former, but not the latter.
  - 8fingerlouie 1y ago
    That kinda leaves (current) biometrics in a gray zone, as fingerprints and faces can be regenerated. You literally leave your fingerprint on every surface you touch, and faces can be covertly photographed.
    - baseballdork 1y ago
      I believe they were referring to the fact that you can't hit a button and generate new fingerprints for yourself. The ones you have are with you forever, generally.
      - aeonik 1y ago
        Assuming you don't get a paper cut or something.
immibis 1y ago
Actually, all three factors are things you know: Your password is something you know. The private key on the security processor is something you know. And your scan of your fingerprint is something you know.

ajnin 1y ago

Client certificates have existed for basically as long as encryption. Passkeys are more than that, and that is a crucial point. They allow to verify the identity of the signing device, and allow access only if the device is "legitimate" from the point of view of the remote service. That is a very big encroachment on the user's privacy and freedoms and a new very big step in the process of tying everything even more tightly to accounts and devices controlled by the big service providers and making it more difficult to get out or to enter the market for new actors. Think Trusted Computing. Soon it will be impossible to log in to some media streaming platform, for example, if you don't have a passkey sanctioned by an OS with a TPM. Then everything will be locked in and the only flaw will be our eyes and our ears.

8fingerlouie 1y ago
Absolutely, passkeys couple a trusted device (typically a phone with HSM) with asymmetric encryption. HSM ensures that the device is actually the device it claims to be, as the key cannot leave the device, and by coupling it with biometrics, which is authentication, you prove to the device you are who you claim to be. So by the device authenticating you, the device by extension can authenticate you against the remote site using a cryptographic challenge. There is no vendor lock in however. You can use a password manager like 1Password to store passkeys, or even Apples keychain supports synchronizing the passkey across devices (including windows). KeepassX also supports passkeys, so it’s not limited to official vendors like TPM. As for HSM, you can also use something like a Yubikey.
mathiaspoint 1y ago
Oh yeah fuck off with that. I was wondering why I couldn't just use a client cert (or better yet my ssh keys) and figured it would be something like that. It turns out I was right to invest zero time or energy figuring it out.
- 8fingerlouie 1y ago
  Passkey is literally an open standard under the FIDO alliance. https://www.yubico.com/blog/10-things-youve-been-wondering-about-fido2-webauthn-and-a-passwordless-world/ https://www.yubico.com/blog/10-things-youve-been-wondering-a...