Technology

59308 readers

4530 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

271

Passwords have problems, but passkeys have more (world.hey.com)

submitted 4 weeks ago by exu@feditown.com to c/technology@lemmy.world

187 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] lobut@lemmy.ca 47 points 4 weeks ago (2 children)

Yeah I didn't understand passkeys. I'm like why is my browser asking to store them? What if I'm using another browser? Why is my password manager fighting with my browser on where to store this passkey?

I felt so uneasy.

So I decided not to use passkeys for now until I understood what's going on.

[–] mosiacmango@lemm.ee 20 points 4 weeks ago* (last edited 4 weeks ago) (1 children)

Passkeys are unique cert pairs for each site. The site gets the public key, you keep the private to login under your account. The site never stores your private key.

To store them simply, turn off your browsers password/passkey storage. Store them in your password manager along with other sites passwords.

[–] lobut@lemmy.ca 7 points 4 weeks ago* (last edited 4 weeks ago) (1 children)

Sounds similar to the SSL stuff, like for GitHub and stuff. I guess the preference in that case would be my password manager as it stores my password already.

Perhaps it's best I pay for Bitwarden premium now and use those hardware keys people are recommending.

Also thanks!

[–] jatone@lemmy.dbzer0.com 14 points 4 weeks ago

Because its the same shit. passkeys are essentially passwordless ssh certificates. we've had functional MFA for ssh literally since its inception.

[–] EncryptKeeper@lemmy.world 11 points 4 weeks ago* (last edited 4 weeks ago) (1 children)

I'm like why is my browser asking to store them? What if I'm using another browser? Why is my password manager fighting with my browser on where to store this passkey?

The answer to all of these questions is “For the exact same reason they do all these same things with passwords”

Think of a passkey as a very, very complex password that is stored on your device (or in a password manager) that you can use to log into websites with without ever having to know what the password is, and it’s never stored on the site you’re logging into, even in a hashed format, so it literally can’t be exposed in a breach.

It’s the exact same technology you use to connect securely to every website you visit, except used in reverse.