> What is a passkey?
> Any passwordless FIDO credential is a passkey.
I would recommend [1] as an excellent overview of the FIDO2 and WebAuthn standards that underlie passkeys. depending on how you use your Yubikeys, you may already be using these standards.
if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal. if you're using your Yubikeys for FIDO2-based MFA you're already getting the majority of the benefit.
This is where I'm at personally right now; basically just waiting for my favorite password manager to add support for passkeys. After that the transition will be pretty seamless; I'll just start storing passkeys in my password manager instead of passwords wherever possible, and get a nice UX improvement as a result.
For users who already have a very good security posture the security benefits of passkeys are pretty marginal. For example, I already use a long, unique password for each site via my password manager. If a site gets breached it will only affect that specific site, and even then only if they store passwords in plaintext. My passwords have enough entropy that even an MD5 hash is unlikely to be cracked in an offline attack. For me the biggest potential benefit of passkeys is better UX when signing in to websites.
Depends on how the password manager stores the passkeys.
I noticed that bitwarden stores TOTP keys such that the secret is exportable. Which means that if you're bitwarden wallet is compromised, even temporarily, the TOTP keys can be stolen.
If the password manager just stores the private key as an encrypted file, then it would probably be better to use a yubikey, iOS or Android device as those are designed to prevent the key from being extractable.
But maybe password managers will store passkeys a HSM.
I'll continue to use WebAuthn hardware keys as a second factor for the small minority of sites where that makes sense. For the rest I'll just use passkeys synced to my password manager.
"What is a passkey?" might as well redirect to zombo.com.
Oh great. So a physical security key could be a passkey, but only if it's used as 1FA not 2FA. At the same time, this weird "store key material in a device and optionally sync to the cloud" thing is called passkey, but if someone uses it as 2FA it suddenly isn't a passkey?
The other thing is that it is more convenient to have "discoverable credentials" (a.k.a. "resident keys") so the browser can check if there are passkeys stored on your FIDO2-authenticator for a specific website. (instead of asking for a username first)
Syncing is optional but if your passkey is not synced, it is usually called a "device-bound passkey" (e.g. Windows Hello).
Having a security key handle unlocking your platform authenticator/password manager seems to be the middle ground that's being driven towards, and as somebody with multiple YubiKey's I'm perfectly fine with it.
Sure, authentication could also be done without resident keys, but resident keys simplify the authentication workflow a lot, since the relying party doesn't need some additional credentials to send the correct wrapped key.
(Disclaimer: I have several Yubikeys.)
> [The definition "passkey is a resident key"] has become so invasive that even FIDO now use it as their definition.
but the linked FAQ for "their definition" doesn't contain the word "resident" (anymore?).