3 ms·
Passkeys are still a shared secret, aren't they? Asymmetric cryptography would have been amazing. Barring that I would actually recommend Oauth or something lik
by kqr 1y ago
Passkeys are still a shared secret, aren't they? Asymmetric cryptography would have been amazing. Barring that I would actually recommend Oauth or something like it, to limit the number of parties who manage shared secrets to a smaller set of actors who have more experience doing so.
- kro 1y agoThey are in fact public/private keys and use signing a challenge for authentication.
- barrkel 1y agoBut in practice they usually rely on attestation by an approved vendor, and the vendor won't let you control your private key, so they'll leverage it for lock-in.
- growse 1y agoNo, they're just resident webauthn credentials which use asymmetric crypto.