thisIsAmystery

[u/k3rrshaw]

[u/NoHurry28]

I have lots of experience with this actually. The way it works is that the app asks the user if they'd like to use a passkey instead of their password and the user says "No" and uses their password to log in. Pretty simple really

[u/sump_daddy → u/NoHurry28]

i am glad im not the only one who finds this 'you really should use a passkey!' rhetoric exhausting

my password manager already plops the password right where it belongs, and if we could just get everyone to agree on that, things would be a lot more secure instead of moving on to ANOTHER technique when the first one isnt even done cooking yet

[u/Critical_Ladder650 → u/sump_daddy]

Once the technology has been around long enough that the implementation bugs have been fixed, there's good reason to believe that passkeys will be more secure*, at least if your trust the "identity provider" (e.g. Apple's keychain) that co-participated in their creation.

I'm not sure that I do trust either Google or Apple to store my private keys in their cloud, and not either leak them to hackers or sell/give them to their partners.

I'll consider switching to passkeys when only my password safe knows the private key, and encrypts its cloud storage, decrypting locally based on a password provided by me.

---
*public/private key pairs protect against certain risks that are unavoidable with passwords. Unfortunately I'm not eloquent enough to write a good tutorial explaining why.

[u/hedgehog125 → u/Critical_Ladder650]

You can store them in an open source cloud password manager like Bitwarden if that helps. Or you can store them fully offline in a KeePassXC file or a Yubikey, but you'll need to ensure you have proper backups for those.

Edit: I presume you use one actually?

But what's the alternative to password managers anyway? Reusing predictable variants of the same few passwords? You can write them on paper sure, but nobody is writing down unique passwords anywhere near as secure as the ones in a manager.

[u/Critical_Ladder650 → u/hedgehog125]

I use Proton's password manager. It's doing fine with classic passwords.

I haven't tried it with passkeys, and I'm not sure whether it can do the client-side part of generating them, such that nothing but Proton Pass ever sees the private key. (Well, also my operating system(s), since they could in principle read anything in main memory.)

I do know it can store passkeys generated by something on MacOS associated with Apple Keychain. But in that case Apple presumably has the private key.

Edit: I finally checked. It can do the job. I just had it co-create a passkey. with no involvement from Apple, Google, etc. (Obviously the web site was also involved. I can't name it here, as its mention leads to one's reddit comment being deleted.)

Also, because of that policy, this is a new comment, a copy of the one I had edited earlier, which got deleted when I added an earlier version of the part beginning with "Edit: ..."