“Passkeys,” the secure authentication mechanism built to replace passwords, are getting more portable and easier for organizations to implement thanks to new initiatives the FIDO Alliance announced on Monday.

  • shortwavesurfer@lemmy.zip
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    Actually, it is still a problem, because passwords are a shared secret between you and the server, which means the server has that secret in some sort of form. With passkeys, the server never has the secret.

    • Programmer Belch@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      0
      ·
      2 months ago

      Best password manager is offline password manager.

      KeepassXC makes a file with the passwords that is encrypted, sharing this file with a server is more secure than letting the server manage your passwords

      • hikaru755@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        This is not at all relevant to the comment you’re responding to. Your choice of password manager doesn’t change that whatever system you’re authenticating against still needs to have at least a hash of your password. That’s what passkeys are improving on here

    • Gutless2615@ttrpg.network
      link
      fedilink
      English
      arrow-up
      0
      ·
      2 months ago

      The shared secret with my Vaultwarden server? Add mfa and someone needs to explain to me how passkeys do anything more than saving one single solitary click.

      • 4am@lemm.ee
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        When a website gets hacked they only find public keys, which are useless without the private keys.

        Private keys stored on a password manager are still more secure, as those services are (hopefully!) designed with security in mind from the beginning.