Hacker News Reader

Comment by ecesena | Hacker News Reader

At the end of the day passkeys are a public/private key pair. While now they're new and it seems everybody's doing some sort of lock in, I would expect standards to emerge soon to export the private keys and reimport them in a different apps.

Unlike passwords, passkeys protect against phishing and are not shared with the server (the server knows the public key, not the private one).

Biometrics on phone are used to unlock password manager/passkeys, but they're not sent to the server (thanks god!) for verification. So they can't really be used for remote authentication.

View on HN

You hit it right. It's not much different than saving your HOTP/TOTP key into your password manager. Instead you'd save the WebAuthn private key and nobody could impersonate you without gaining access to your private key from your password manager (1Password, Android, iOS, Chrome, etc.). At least that is how I have come to understand the inner workings of it all. People rely on PKI for encrypting messages, signing messages, secure remote access, etc., so I think it only makes logical sense to extend it to web application authentication.

So this really isn't just an updated SSO implementation its an entirely different mechanism. I did not realize that.

I am a bit worried that the standards and ability to move around is not just part of the implantation right out the gate.

I do worry what this will mean for the more average user, this is a major shift in how things work.

It’s not really a new standard, it’s FIDO2, it’s been around for a while using security keys (yubikeys, solokeys…).

Passkeys used to be called non-resident keys.

In the world of hardware security keys there was no backup/share of private keys.

In this new wave of software authenticators (typically backed by the hw coprocessor that’s now available in phones & laptops), they called them passkeys, added sharing across devices, and a few debatable features like interactions with servers that may lead to lock in/tracking/etc (or may not).

Correct. Nothing is centralized about Passkey (other than where you may choose to store your authenticators). Each site gets a unique keypair. If your keypair is compromised you can delete it on that given site.

Passkeys is more or less just a more convenient implementation of FIDO2 or the like, as you'd traditionally have with a Yubikey token. Instead you move it to a supported password manager or mobile device.

If you want to try it out go to https://passkeys.io on your Android or iOS device. I do believe Passage is more or less what Passkeys is/already was.

Reply on news.ycombinator.com