this post was submitted on 14 Oct 2024
496 points (99.6% liked)
Privacy
32159 readers
391 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If they're not portable how would I for example login to an account while on my Desktop, if I set up the passkey on my Phone?
You generate a second one on the other device.
Assuming that all services you log into support multiple passkeys. My auto financing company doesn’t, for example
Well, then it seems like they have not understand the idea behind passkeys, like so many..
I'd like to see some documentation that says passkeys were intended to never be synced across anything.
Everything I have ever read is that it's basically asymmetric cryptography like ssh keys. You have a private one, generate the public and give it to the site. It stops reuse of passwords and site breaches become useless as the public key is useless for attacking an account on another site, etc. (well, besides whatever data was lost in the breach which is outside the scope.)
I see no reason to limit someone having the private key on their phone, their desktop, etc. Having to generate yet another passkey for every device is inefficient and would decrease adoption of this.
Yea, ssh private keys as well are intended to only stay on Device that generated it. The idea is, that the device you want to connect to has all the puplic keys of all devices you want connect from in their known hosts directory. And you should not transfer private keys.
But of course there is always a battle between convince and security, so there were ways created to transfer encrypted private keys protected with a password.
And the same happened to passkeys.
I myself choose convenience over security in that regard and share my private keys and passkeys on my devices and thus am happy about that development.
The thing is, having options is often good, so a person should be able to choose passkeys in the secure way where you can invoke each device individually and never have the passkey to leave the device where it was generated. To achieve this, website need to allow multiple passkeys to be used, and would be expected from a bank, in my opinion. Maybe they think it is more secure to have just one passkey on one device, which it is, but how do you recover your account if that device dies?
There are already systems in place that allow temporary passkey sharing, for example with a QR code (CaBLE) https://www.corbado.com/blog/webauthn-passkey-qr-code
Doesn't that imply you still have to open up your phone to temporarily share to your pc whenever you need it?
Yes but when you are logged in, you can add the passkey that belongs to the new device to your account
That doesn't transfer the private key though (or at least it shouldn't).
I'm pretty sure it's just transferring public keys and signing the response with the private key on your phone.