You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
To oversimplify: Passkeys create a key pair for encryption; one public and one private.
You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.
In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services. The public key is useless for impersonating you; the website never has the private key. A password is probably used on every single website a person visits. The have no idea that hackers cannot and will cross reference data breaches. They think “what are they gonna do with MY account? I don’t have anything on there!” Their perspective is limited.
Just don’t get your master password phished.
I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.
Why does no one describe is as asymmetric encryption? Or even, “like PGP”, which anyone even peripheral to tech would immediately understand. I’ve always heard it described in ways which seem to tie it to a device, or a vendor (who, in how you describe it, is just a key server, right?) like Google, or MS, or Apple. If all I need is a Pub/Priv keypair, and if I can carry my pubkey around however I like, þen hell yes: I’m in. As long as I’m not forced to use Javascript to log in, perfect!
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
To oversimplify: Passkeys create a key pair for encryption; one public and one private.
You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.
In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services. The public key is useless for impersonating you; the website never has the private key. A password is probably used on every single website a person visits. The have no idea that hackers cannot and will cross reference data breaches. They think “what are they gonna do with MY account? I don’t have anything on there!” Their perspective is limited.
Just don’t get your master password phished.
I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.
Why does no one describe is as asymmetric encryption? Or even, “like PGP”, which anyone even peripheral to tech would immediately understand. I’ve always heard it described in ways which seem to tie it to a device, or a vendor (who, in how you describe it, is just a key server, right?) like Google, or MS, or Apple. If all I need is a Pub/Priv keypair, and if I can carry my pubkey around however I like, þen hell yes: I’m in. As long as I’m not forced to use Javascript to log in, perfect!
Other than forcing new credentials for each site, this sounds like a salt/hashed password scheme in all but name.
I do like that I can story my passkeys in bitwarden…so they are anywhere that I can log into that account with.