3 ms·

How else would you make the private key unexportable and the passkey uncopyable?

• stavros 10mo ago
  You wouldn't, and still passkeys don't require this.
  • bgbntty2 10mo ago
    [dead]
  • coldpie 10mo ago
    Passkeys don't require it, but relying-parties may: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994182200 https://github.com/keepassxreboot/keepassxc/issues/10407#iss... If enough RPs ban clients that let users manage their own data in the name of "security," then it is effectively required by passkeys. The passkey spec could have been written to be resilient against this type of abuse, but instead this abuse is explicitly considered a feature of the spec.