• Big Tech has implemented passkeys in a way that locks users into their platforms rather than providing universal security
  • Passkeys were developed to replace passwords for better account security, but their rollout by Apple and Google has limited their potential
  • Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
      • hydration9806@lemmy.ml
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        7 months ago

        Passkey = Resident Key

        Nonresident keys are not passkeys, they are solely a second form of authentication meaning the service you are logging into still requires a password.

        • Spotlight7573@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          7 months ago

          Couldn’t a site theoretically use a nonresident key with just a username, in place of a password?

          This seems to imply it might be possible:

          https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Resident_Keys.html

          Discoverable Credential means that the private key and associated metadata is stored in persistent memory on the authenticator, instead of encrypted and stored on the relying party server. If the credentials were stored on the server, then the server would need to return that to the authenticator before the authenticator could decrypt and use it. This would mean that the user would need to provide a username to identify which credential to provide, and usually also a password to verify their identity.

          • hydration9806@lemmy.ml
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            7 months ago

            For sure, but that still isn’t a passkey. The method you are talking about is the equivalent of non-passphrase protected SSH protocol, which is a single form of authentication (i.e. if someone has your security key they have your account).

            The term passkey implies MFA: having a physical key and a password, a physical key and a fingerprint scan, or equivalent.

            Sure the username could be considered the password, but usernames are not designed to be protected the same way. For example, they typically are stored in clear text in a services database, so one databreach and it’s over.

    • BeatTakeshi@lemmy.world
      link
      fedilink
      English
      arrow-up
      20
      arrow-down
      18
      ·
      7 months ago

      How is 25 bad? Do you need a passkey for each service /app/website? Can’t you use the same key for many services? (trying to understand how they work)

      • lemmyvore@feddit.nl
        link
        fedilink
        English
        arrow-up
        19
        ·
        7 months ago

        Ideally yes, they’re supposed to eventually replace all passwords. Of which I have hundreds. And yes not 100% of them will do that on the near future but a lot more than 25 will.

        • capital@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          ·
          7 months ago

          Being down-voted for asking questions is bullshit. Your questions are valid and those people suck.

      • CriticalMiss@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        ·
        7 months ago

        I have 150 passwords in my password manager. I’m not buying 7 YubiKeys (and to be fair that’s not what they’re designated for)

      • laughterlaughter@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        3
        ·
        7 months ago

        No, sharing passkeys across services is way too risky. One service gets compromised, someone gets your passkey, and then they have access to all of your services. It’s the same principle with regular passwords.

        • Spotlight7573@lemmy.world
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          7 months ago

          Uh, each service only has access to your public key, not the private one that stays with you. It’s less risky than a regular password.

          Even with U2F hardware keys where the server-side stores the encrypted key (to allow for infinite sites to be used with a single hardware key), it’s only decryptable on your key and thus isn’t that useful for someone who has compromised a service.

      • paraphrand@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        7 months ago

        Having a key shared across sites wouldn’t be great. If it was great it would be an article talking about “passkey” not “passkeys” because you would just have one. Like some sort of Skeleton Passkey that unlocks all your shit when compromised.

      • Natanael@slrpnk.net
        link
        fedilink
        English
        arrow-up
        3
        ·
        7 months ago

        You only need one per website if you want it to autofill the username, because resident keys held on the security token can be recognized and suggested automatically but otherwise you must first enter your username on the website and let the website send its challenge value for the corresponding domain and account pair so that your security token can respond correctly.