Passkeys replace passwords with encrypted key pairs that can’t be phished or leaked. Learn how FIDO2 and WebAuthn work, their pros and flaws.

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

  • Doccool@lemmy.worldEnglish
    271·
    7 hours ago

    Currently I use a FOSS (I think?) password manager, BitWarden, that supports passkeys. I use it across Mac, Windows and Android so I’m while my passkeys are locked yo the password manager, I am not locked to any of the aforementioned megacorps.

    • kjetil@lemmy.worldEnglish
      2·
      2 hours ago

      I use BitWarden too. OS , device and browser agnostic is a win

      But I imagine the vast amount of people will use whatever their platform is pushing, so Apple Google or Microsoft. And in 5 years time “3rd party passkeys” are not “secure enough” and blocked by the OS. (Ok that’s a bit tinfoil hat, but Google’s recent Android app developer verification scheme is fresh in mind)

    • Septimaeus@infosec.pubEnglish
      8·
      5 hours ago

      KeePassXC has begun rollout of their own implementation, and I’m pretty sure they’re considered FOSS.

      From a quick scan of the white paper, it appears they’re currently using on-device passkey discovery and otherwise “intercepting” passkey registration workflows, which I take to mean they aren’t originating the request as a passkey registrar. This may be the easiest method to satisfy FIDO’s dID requirements.

    • SkaveRat@discuss.tchncs.deEnglish
      16·
      7 hours ago

      While I use and love bitwarden, it’s not exactly foss. Although there is a foss implementation of their server backend