3 ms·
Yes. That's one of the primary use cases of a YubiKey (or other FIDO 2 hardware keys). Please note that there are 2 types of passkeys: - resident keys: Actual
by vaylian 1y ago
Yes. That's one of the primary use cases of a YubiKey (or other FIDO 2 hardware keys).
Please note that there are 2 types of passkeys:
- resident keys: Actually stored on the hardware key
- non-resident keys: Keys that are recalculated on the fly based on a secret seed value, the domain that the service is for and the username. The advantage is that these don't take up any storage space
Resident keys have the advantage that they remember the username. But there is only a limited number of keys (about 100 on new YubiKeys but there are still a lot of older hardware tokens being used) that you can store on a hardware token. Non-resident keys have the advantage that you can "store" an infinite number of them on your hardware token.
See https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
- timmyc123 1y ago> Please note that there are 2 types of passkeys This is not really correct. Non-resident keys are not passkeys. The two types of passkeys are synced and device-bound. Synced passkeys are typically stored in software-based credential managers, while device-bound passkeys are typically stored in hardware security keys or hardware-based credential managers.