Technology
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
view the rest of the comments
I’m sorry, but this still sounds as much like “Mares eat oats” as it did when I first heard it a decade ago. You still enter a username and password somewhere (ideally in your password manager) to gain access to your account.
The difference is, that even if you enter the "password" on a phishing site, it is useless. Or when the server is compromised.
The only way the passkey can get compromised, is when the device that holds it gets compromised.
The same reason why hardware tokens for things like FIDO or U2F are recommended.
That makes no sense to me — and I’m not technically illiterate. If it makes no sense to someone like me, there was never any hope that it would be adopted by the masses who just want things to work. Google may not have helped here, and I’m certainly not among their fans, but it’s hardly entirely their fault that it never caught on.
You need to check out public key cryptography and digital signatures. Those are the basics of Fido.
When the private key is bound to a device it is not possible to fake or steal it through conventional methods. Passwords are the weakest link and an easy target for attackers - passkeys basically solve that.
User adoption depends on implementation, but everything is easier than remembering a secure password or using a password manager for most people. There needs to be an easy and secure way to distribute passkeys across devices, and any backup mechanisms may be a weak point. In any case: still better than passwords.