Questions tagged [passkey]
The passkey tag has no usage guidance.
20 questions
1
vote
1
answer
56
views
Does a Passkey authentication system need bootstrapping by username and password?
The Register has an article on Passkeys, and one of the issues they use to argue that they are unlikely to be widely adopted is:
The process is bootstrapped by getting the user to authenticate using ...
- 375
1
vote
1
answer
51
views
What is the easiest way to have a standalone implementation of Passkeys on generic hardware with backup?
In previous question I asked about simple login systems, and WebAuthn was the answer. From a brief read of the web pages I THINK it is possible to create a standalone GPL implementation of Passkeys ...
- 375
2
votes
1
answer
88
views
Storing a server secret in a user passkey user id
I want to implement passkey support as a full replacement for passwords but I have some server-side state that still needs to be encrypted to a specific user in a way that can not be decrypted or ...
- 123
1
vote
1
answer
123
views
Is there a private, secure and easy login system?
I am trying to figure out the implications of authentication technologies. Answers to a previous question indicate my real question is more "meta than that.
The primary requirements for an ...
- 375
1
vote
1
answer
116
views
Is there an equivalent to passkeys but to prevent cookie stealing?
Passkeys prevent phishing, no one can make you login remotely (without exploits) and if they are hardware based and never leave the hardware, them even exploits might have a hard time getting them.
...
- 375
9
votes
3
answers
1k
views
Passkeys: MFA or not?
According to different pages (e.g. OneIdentity, also a Google Security source I can't find anymore), using Passkeys does count as Multi Faktor Authentication. To my understanding, they argue, that the ...
- 193
1
vote
1
answer
74
views
Considerations when setting up passkey + TOTP login
I'm trying to create a simple web-app (for personal use, but also trying to learn some things along the way). If the stack is important, I'm using:
SvelteKit for Frontend
Netlify Functions for the ...
-1
votes
1
answer
114
views
Fido2/Webauthn Passkeys: rsa2048, rsa4096, or Ed25519?
Does anyone know what kind of keys are being generated when you make a Fido2/Webauthn passkey? rsa2048, rsa4096, Ed25519, or something else? Just worried if its rsa2048 it might soon be crackable, at ...
- 179
6
votes
2
answers
2k
views
How is a passkey more secure than the regular email/password with U2F key?
Since I use 1Password to store my passkeys along with emails and passwords, it appears to be that passkeys are not as secure as using the email and password with U2F flow that I currently use on many ...
- 161
3
votes
2
answers
766
views
What are the security pros and cons of setting up passkeys for Gmail logins?
Today while signing on to Gmail with my iPad, I was prompted:
With passkeys you can now use your fingerprint, face, or screen lock to verify it’s really you.
I was wondering what the security pros ...
0
votes
0
answers
164
views
Why whatsapp only let you create 1 passkey?
Whatsapp is rolling out passkeys. I don't think backing up passkeys in a password manager is a good idea. I'd like to have device bound passkeys but they only allow me to create one. How should I be ...
- 375
0
votes
1
answer
149
views
Will sky fall if I don't verify `AuthenticatorAttestationResponse`?
Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
- 374
2
votes
0
answers
174
views
Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?
If we want to enable an authenticated connection via BLE the passkey method seems like a good idea. A 6-digit PIN is generated randomly on one device and has to be entered on the other - these 20 Bit ...
- 71
0
votes
1
answer
247
views
Are passkeys anonymous?
I was considering using passkeys as a 1FA. I wanted users to login/register without email or password and without logging their IP.
But being anonymous would probably bring very bad things to any site....
- 103
0
votes
1
answer
322
views
What is the benefit of a passkey over using 2FA like Google Authenticator?
At the moment to log into (for example) Paypal I type a password then the code from Google Authenticator. If I understand correctly having a passkey installed on my phone eliminates the password. It ...
- 101
13
votes
2
answers
2k
views
Do passkeys allow an attacker to gain account access by accessing a single device?
Some companies such as Github suggest passkeys replace both passwords and 2FA:
passkeys satisfy both password and 2FA requirements
Github thus allows logging in with a passkey without any second ...
- 233
2
votes
0
answers
165
views
Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?
So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc):
When creating a platform authenticator, ...
- 178
2
votes
2
answers
3k
views
Are passkeys a secure replacement for 2FA?
Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my ...
0
votes
1
answer
351
views
Why does iOS allow using passkey without biometric? [closed]
One of the touted features of passkeys is that they depend on a biometric in order to use them. However, on an iPhone, if the finger-print scanner isn’t successful, it offers you the option of using ...
- 1,177
0
votes
0
answers
88
views
Passkey for user not present app?
Is a passkey (plus auth code grant) a reasonable/ appropriate replacement for JWT grant flow?
I'm currently using JWT for an autonomous app (user not present).
Does passkey require web browser ...
- 599