this post was submitted on 11 Aug 2024
83 points (96.6% liked)
Privacy
32424 readers
314 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Passwords can be leaked, mostly by bad security on server side.
Passkeys use secure keys, it checks public keys on both sides and send private key to authenticate, without both keys can't login or if the server is compromised.
It's like GPG or SSH works.
Close but private keys don't get sent.
It sends information encrypted via your public key to your client, then your client proves that it's the real owner of the key by decrypting the message, and then sending a new message back encrypted by the private key that the server can then verify.
This is what's better than a password, the information for providing authentication (the private key) never leaves your computer (where as you almost in all implementations of password based auth, send the password itself to the server).
A question, since you sound like you know what you're talking about. Is this analagous to password-free SSH? I.e., private key used to log in on the basis of a pre-agreed public key?
Yeah basically. See "What is a passkey" on https://fidoalliance.org/faqs/#PasskeysFAQs
Which begs the question, "What is FIDO?". To which the About FIDO page replies, literally, "FIDO authentication uses standard public key cryptography techniques to provide phishing-resistant authentication".
Arrghghgh! Orwell was right about people's incredibly capacity to write with zero clarity.
More generally, IMO what we have here is a classic case of ELI5 vs "ELI know something already". I use SSH and manage the keys myself but I still can't find an answer to this question: is a "passkey" just another word for "the private key in a public-private keypair?"
Whenever I look into this, the explainer always either jumps straight into super-dense technical details, or describes it all in term of metaphors as if talking to a small child. Oh well.
Reading through all the jargon and simplifying it, the answer: yes they're the same in the way you mean.
"SSH" and "passkey" are both technologies built on asymmetric cryptography. They thus at a fundamental level do work in the same way, it's all the protocol and practices stuff that gets bolted on that is where things become different and where things took time to get into place so we could use these things on the web (and not just "we" who know what SSH is but "we" who make up society).
The problem is arguably that for the people who understand it enough to say "yeah, they're the same idea", the key point is "asymmetric cryotherapy" in an authentication context, the key point is not SSH. SSH is just how most technically inclined users have most directly experienced asymmetric cryptography deployed as an authentication mechanism. It's that same mistake textbooks often make of burying the lead in an otherwise obscure reference the reader may or may not pickup on.
But yes, it would be helpful if some major site would provide this comparison "so that I don't have to! π"
See also "Enrollment and Sign-in with FIDO" in https://fidoalliance.org/how-fido-works/
Exactly. Thanks for clarifying.
It's PKI, public key infrastructure. It's secure so it's used in many applications. Including ssh using keys.
It sends the private key? Are you sure about that?
Just like positrons are the opposite of electrons maybe passkeys send private keys and keep the public ones in PKIβ¦ waitβ¦
Wouldn't this be solved by storing only hashed passwords?
Let's assume that hashing passwords falls into the "good security" bucket, and wouldn't be part of the "bad security" scenario.
Figured as much. I thought that was just "standard", but even "standard" can be a lot to expect lol