Questions tagged [passkey]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
DannyNiu's user avatar
  • 374
2 votes
0 answers

Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?

If we want to enable an authenticated connection via BLE the passkey method seems like a good idea. A 6-digit PIN is generated randomly on one device and has to be entered on the other - these 20 Bit ...
jusaca's user avatar
  • 71
0 votes
1 answer

Are passkeys anonymous?

I was considering using passkeys as a 1FA. I wanted users to login/register without email or password and without logging their IP. But being anonymous would probably bring very bad things to any site....
Mike's user avatar
  • 103
0 votes
1 answer

What is the benefit of a passkey over using 2FA like Google Authenticator?

At the moment to log into (for example) Paypal I type a password then the code from Google Authenticator. If I understand correctly having a passkey installed on my phone eliminates the password. It ...
John Rennie's user avatar
11 votes
2 answers

Do passkeys allow an attacker to gain account access by accessing a single device?

Some companies such as Github suggest passkeys replace both passwords and 2FA: passkeys satisfy both password and 2FA requirements Github thus allows logging in with a passkey without any second ...
holocronweaver's user avatar
2 votes
0 answers

Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?

So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc): When creating a platform authenticator, ...
xsrf's user avatar
  • 178
1 vote
2 answers

Are passkeys a secure replacement for 2FA?

Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my ...
Anthon Nilsson's user avatar
0 votes
0 answers

Difference between PassKeys and using touch-id to login in Apps

PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance. I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to ...
Procrastinator's user avatar
0 votes
1 answer

Why does iOS allow using passkey without biometric? [closed]

One of the touted features of passkeys is that they depend on a biometric in order to use them. However, on an iPhone, if the finger-print scanner isn’t successful, it offers you the option of using ...
Ian Warburton's user avatar
0 votes
0 answers

Passkey for user not present app?

Is a passkey (plus auth code grant) a reasonable/ appropriate replacement for JWT grant flow? I'm currently using JWT for an autonomous app (user not present). Does passkey require web browser ...
Larry K's user avatar
  • 601