3 ms·
I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to
by voxic11 2mo ago
I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to log in. I could see this become a pretty common pattern.
I like it because I can use discord on even a pretty untrusted computer without providing it any credentials or access to my passkey, and then later when I'm done I can revoke the session.
- OJFord 2mo agoOk but now do a service that doesn't support that, whether or not it might in the future 'become a pretty common pattern'.
- jeroenhd 2mo agoOn most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS. You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems. Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.
- HelloUsername 2mo agoWhy does a passkey need bluetooth? For what? Isn't that another vulnerability?
- jeroenhd 2mo agoA "passkey" is a bunch of metadata and a public/private keypair. It doesn't do anything by itself, of course. A physical device, like a Yubikey or a Titan, doesn't have Bluetooth. For phones and tablets these keys do support NFC but that's a whole different story. The Bluetooth connection is how your phone exchanges the key and authenticates you through the computer. In its most secure phone, the key never leaves the dedicated security hardware/trusted execution environment that protects your key from snooping, the same way you cannot get a physical U2F key to give you the private key bits. You scan a QR code to set up the pairing/connection process (if you haven't already), then a Bluetooth Low Energy exchange happens. You confirm you want to sign in on your phone (so you don't get tricked into scanning a QR code), then the cryptography happens that authenticates you. You can find the protocol here: https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl... It should be noted that, at least on Android, any credential manager app will support this exchange. The passkeys in the Bitwarden app on my phone work just like the native Android key store when scanning a QR code, for instance, and other apps will also work. You can switch authenticator apps in the pop-up, or set a dialog in the Android settings if you want to switch the default. Furthermore, there are also CTAP2 implementations for smartwatches (at least for Android smartwatches) that let you authenticate with a tap on the watch. That flow doesn't use a QR code for obvious reasons, you would need to manually connect your computer to the watch before it works. I believe https://github.com/fmeum/WearAuthn https://github.com/fmeum/WearAuthn is the prime open source example of this feature.
- HelloUsername 2mo agoTIL! Thank you for taking the time explaining this!
- bcye 2mo agoI don’t think this ever works with passkeys stored in pw managers though, only Face ID/whatever Android is doing?
- Hardwired8976 2mo agoIt does using 1password.
- jeroenhd 2mo agoIt works perfectly for passkeys stored in Bitwarden on Android. Don't know what iOS is doing.
- kasabali 2mo agoso you need to have discord installed in your phone. now multiply it with every web site you want to access.