Questions tagged [passkey]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
110 views

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
DannyNiu's user avatar
  • 374
2 votes
0 answers
91 views

Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?

If we want to enable an authenticated connection via BLE the passkey method seems like a good idea. A 6-digit PIN is generated randomly on one device and has to be entered on the other - these 20 Bit ...
jusaca's user avatar
  • 71
0 votes
1 answer
163 views

Are passkeys anonymous?

I was considering using passkeys as a 1FA. I wanted users to login/register without email or password and without logging their IP. But being anonymous would probably bring very bad things to any site....
Mike's user avatar
  • 103
0 votes
1 answer
168 views

What is the benefit of a passkey over using 2FA like Google Authenticator?

At the moment to log into (for example) Paypal I type a password then the code from Google Authenticator. If I understand correctly having a passkey installed on my phone eliminates the password. It ...
John Rennie's user avatar
11 votes
2 answers
1k views

Do passkeys allow an attacker to gain account access by accessing a single device?

Some companies such as Github suggest passkeys replace both passwords and 2FA: passkeys satisfy both password and 2FA requirements Github thus allows logging in with a passkey without any second ...
holocronweaver's user avatar
2 votes
0 answers
108 views

Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?

So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc): When creating a platform authenticator, ...
xsrf's user avatar
  • 178
1 vote
2 answers
1k views

Are passkeys a secure replacement for 2FA?

Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my ...
Anthon Nilsson's user avatar
0 votes
0 answers
112 views

Difference between PassKeys and using touch-id to login in Apps

PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance. I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to ...
Procrastinator's user avatar
0 votes
1 answer
299 views

Why does iOS allow using passkey without biometric? [closed]

One of the touted features of passkeys is that they depend on a biometric in order to use them. However, on an iPhone, if the finger-print scanner isn’t successful, it offers you the option of using ...
Ian Warburton's user avatar
0 votes
0 answers
74 views

Passkey for user not present app?

Is a passkey (plus auth code grant) a reasonable/ appropriate replacement for JWT grant flow? I'm currently using JWT for an autonomous app (user not present). Does passkey require web browser ...
Larry K's user avatar
  • 601