It's an improvement over passwords as long as two things are true: 1. Open sourc... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		jksflkjl3jk3 on Dec 4, 2023 \| parent \| context \| favorite \| on: Are Passkeys the beginning of the end of passwords... It's an improvement over passwords as long as two things are true: 1. Open source implementations will be indistinguishable to a 3rd party from the big tech versions (so that services can't refuse to authenticate devices that haven't been locked down), and 2. The private key can be extracted from the device by the user and backed up.

growse on Dec 4, 2023 [–]

Why is #2 important? Passkeys break the 1:1 relationship between credentials and accounts, so just register multiple passkeys.

If it can be extracted, it can be stolen. Better to stick your secret material in a HSM that takes the key with it when it dies.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact