So a passkey is a pubkey cryptographic challenge to the computer, right? So the website only knows a public key and never handles passwords. I guess I see how it's convenient, but it doesn't provide any extra security over the already optimal strong password for each service so whatever.

@chjara Easier to backup, perhaps? (prior art: hash-based password managers, deriving all passwords from a single passphrase, but that idea is not very popular).

@chjara eh, it can’t leak/be intercepted in transit (and if you HW keys, way harder to do even in storage), + there’s a bit of a phishing protection in that it separates the keys per-domain, so you can’t get phished even if you try (unless mitm or sth) and even then it’s not reusable

@chjara unlike passwords it is not possible to enter passkeys into phishing sites as they are bound to a specific origin

@chjara it does, actually. passkeys are app-bound. it’s practically impossible to get a passkey out of someone through fishing

I didn't think about phishing, that's true.

@chjara I guess, but considering how many ppl I see irl reuse the same predictable password its an improvement for an average user

@chjara while I get the phishing protection passkeys add, I feel like big tech os vendors want them so there's another way in which users are locked in their ecosystems

(ok I'm taking off my conspiracy hat off now)

@kc Isn't it an open spec? The only potentially lock in bit of it is that it tends to use the TPM, but I'm pretty sure you can always extract data from there if you can authenticate.

@chjara @kc you can set it up so that the TPM generates the key and never let’s it leave, only signing/decrypting things with it. But you can generally store the key wherever you want, like say KeepassXC. There is stuff with attestation, but that’s generally only used with stuff like work-issued HW keys or banks (some japanese bank was a major contributor to the spec)

@chjara spec is open but afaik most vendors don't allow you to export your passkeys from their store or migrate them to another passkey service