240
What the !#@% is a Passkey?
(www.eff.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 04 Nov 2023
240 points (94.1% liked)
Technology
35006 readers
259 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
They are FIDO2. This is the passwordless stuff yubico has been talking about and working on for ages, plus a marketing name.
https://www.yubico.com/blog/a-yubico-faq-about-passkeys/
Wow! I had no idea. I assumed the yubikey bioseries didn't work with passkeys. But I read the documentation that you linked, and I just tested it out on the demo site. It works.
That's amazing! Thanks
Can only store 25 keys but hey that's still something.
I like that you are able to query what keys are stored, so if you are ever replacing or upgrading the key you can see where you should update to the new one. That is tough on the current yubikey, I've got a few generations of them and have to hold onto them just in case I happened to use them for 2FA somewhere and don't remember it. 2FA is dynamically generated so there's not really a way to change that, it's just inconvenient.
I prefer the yubikey webauthn fido2 non passkey approach. It's not limited to 25 slots. And if your key gets compromised, or you're forced to unlock it, there isn't a list of sites that it works on.
With passkeys, if somebody compromises you, physically, they can see everything you can log into. That makes me feel icky
Can they though? I own a few yubikeys with passkeys stored inside and i cannot query stored logins without entering a pin.
Right, so they coerce you to unlock the yubi key (threats, torture, finger removal, etc) and now they see all your passkeys and what they belong to. It's a menu of your activity.
There are definitely pluses and minuses. It will lock you out after 8 incorrect pins so if it came down to it, you could probably force it to lock pretty quickly.