Big Tech passkey implementations are a trap | Proton

AnActOfCreation@programming.dev to Technology@lemmy.world – 495 points – Big Tech passkey implementations are a trap | Proton
proton.me
  • Big Tech has implemented passkeys in a way that locks users into their platforms rather than providing universal security
  • Passkeys were developed to replace passwords for better account security, but their rollout by Apple and Google has limited their potential
  • Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
214

You are viewing a single comment
View all commentsShow the parent comment

Passkey = Resident Key

Nonresident keys are not passkeys, they are solely a second form of authentication meaning the service you are logging into still requires a password.

Couldn't a site theoretically use a nonresident key with just a username, in place of a password?

This seems to imply it might be possible:

https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Resident_Keys.html

Discoverable Credential means that the private key and associated metadata is stored in persistent memory on the authenticator, instead of encrypted and stored on the relying party server. If the credentials were stored on the server, then the server would need to return that to the authenticator before the authenticator could decrypt and use it. This would mean that the user would need to provide a username to identify which credential to provide, and usually also a password to verify their identity.

For sure, but that still isn't a passkey. The method you are talking about is the equivalent of non-passphrase protected SSH protocol, which is a single form of authentication (i.e. if someone has your security key they have your account).

The term passkey implies MFA: having a physical key and a password, a physical key and a fingerprint scan, or equivalent.

Sure the username could be considered the password, but usernames are not designed to be protected the same way. For example, they typically are stored in clear text in a services database, so one databreach and it's over.