What Are Passkeys? Explained in 2 Minutes

[@cybernews]

Have you tried Passkeys yet? 🤔

[@AzphrinxOfficial]

Yes. I've been using it today and nothing can get hack in

[@AlessandroBottoni]

Passkeys are a lot better than passwords for the regolar user but... if you use passwords for *professional* applications, please use *passwords* plus a 2FA method like hardware authentication tokens, OTP applications and so on. Do not use Passkeys for critical, professional, company/corporate-level apps. For this kind of applications, you need a simple, reliable way to make a *backup* of your keys and a simple, reliable way to recover a failed/compromised system (if/when needed). Having these failsafe options is not so easy when you use passkeys (and *only* passkeys).

[@bigjoegamer]

Developers are working on ways to import and export passkeys. Look up "1Password passkey backup" and look at the 1Password Community links. I got my info from people who post there; people like "Dave_1P". Here's a quote from one of his posts created on October 4 2023:
"Passkeys saved in 1Password can’t be exported at this time. We’re working closely with platform vendors and other password managers through the FIDO Alliance to create a secure way to import and export passkeys. We believe it’s your choice where to store and use your passkeys. Hopefully we’ll have more to share soon."

[@user-jv9wc8sv3u]

How’s about passkey with hardware token combining password between 4 to 127 characters? Is not enough for heavy users?

[@starwarsdude695]

So is it like when you want to log into something on your computer, you get a notification on your phone or something like that. Then you do face ID and it logs you in?

[@hyozanhades09]

I also use multiple yubikeys too for multi factor authentication.

[@RickR69]

The fact that this currently relies on the big companies for authenticating makes me suspect. As someone who uses 2FA and has complex pseudo randomly generated passwords, I'm not convinced this is better.

[@RedMambaYard]

What about the biometric data that are stored to be able to match the biometric input on the device? Can't they be stolen as well? And isn't that worst? Once your account has been compromised, it's bad, but you lost an account (and all the contained information). But once your unique biometric data have been compromised, you can't replace them, and you won't be able to used them elsewhere forever. Or am I missing something here?

[@Leatherman847]

Very high level here glossing over a little too much I think, but cryptography gets complex fast. The biometrics you are referencing or access method such as a pin is a separate authentication method only done with the device in use. Meaning it should be on that device only (e.g. cellphone). Lookup public/private key pairs to understand the underlying methods better, but essentially after authenticating with the device, you have unlocked a key on said device that is used to authenticate with whichever service. Again, glossing over on the in-depth how, but it is like cryptographic password stored in a file, realistically impossible to brute force re-create against a service even if you stole the opposing key, but if you got access to the unencrypted part of the pair on the user's device you could impersonate the user. Access to the file itself would not be enough though, you would require whatever pin, biometric, password, etc that is used to access and unlock said key with a pin being easy to brute force and biometrics needing to be stolen. Using said keypair method though, everywhere the user creates an account, there would be a unique public/private key. Maybe this helps without too much ambiguity and too much butchery?

[@ProfessorJayTee]

TERRIBLE idea. Once they figure out how to "spoof" the passkeys? We're ALL fucked. Now, I have dozens of passwords, so if hackers manage to find one, they don't have ALL OF THEM. If they spoof my passkey, they have access to EVERYTHING I have access to... banks, investments, social media... everything.

[@phils329]

Where do you store all your dozens of different passwords?

[@SnowyRVulpix]

Passkeys can't be spoofed. Its impossible

[@ErickWright]

​@@phils329inside of his brain

[@wakaneut]

@@SnowyRVulpix Never say never

[@PersonalPariah]

To be clear, unless passwords are completely removed from the account creation/login process, surely I'm no more secure than I was before...? If someone has my password and breaks my 2FA then I'm still screwed, whether I have a separate login mechanism set up or not.

[@shaunrocksthecitytvshow4117]

Yeah the video was helpful I found out what me losing my other phone it's a pain in the ass forgetting my account I still can't get in my Shopify account 😒😒😒

[@SnowyRVulpix]

Actually, losing your device isn't an issue. Passkeys are backed up to your google or apple account.

[@RickR69]

Cool. What happens when those are compromised, down or you get your access revoked for any reason?

[@mohamedhussin8024]

thank you

[@EyesOfByes]

People have been using physical keys for millenia, so it should be easier for non tech savy people

[@maslaxmaxamed5959]

Yes thank you

[@MR.E820]

What about malware or Zero-day bugs....Giving Criminals access to your phone without your permission. Seems they could take over your accounts without much effort using Passkey. Security is not about being easy..instead it should be layers of road-blocks for criminals to overcome.

[@iamphantasm0]

Just remember that one pass to your google or iCloud and you can sign in on a new phone and you’re good. Simple

[@ronp5615]

I'll pass on the potential for anything harrowing, lol.

[@StijnHommes]

No. Remembering your passwords is easy if you use a password manager. Also, if your password is sufficiently long and non-predictable something of only 16 characters can take centuries to brute-force.

[@fort6564]

For the everyday joe, passkeys are 100x simplier than using a password manager

[@statusprovider9877]

Super

Yubikey is way better.

[@Petah_C]

Can we do password managers and passkeys together?

[@bigjoegamer]

Yes, because password managers like Bitwarden and 1Password allow you to save passkeys in them and use passkeys you've saved. KeePassXC is an offline password manager that will support passkeys in a future update.

[@Neustocks]

Yes

[@jjmmjj9999]

Did you miss the part where it said passkeys REPLACE usernames and passwords? If a website doesn't support passkeys, you'll use a username and password. So yes a password manager makes sense there

[@Petah_C]

@@jjmmjj9999 o gotcha, was just seeing if I could use them both for extra protection lol and it looks like I can, like using the passkey as 2fa

[@sammiemagi6564]

Where is the How dude

[@SAISATHONEVONGVILAY-hp3jz]

Hi

[@user-ms7oz7go8c]

I like it

[@holyQuran2017]

❤

[@stu.thomason]

The video doesn't explain why it would be a "harrowing" task to restore access to your accounts. This brief statement on its own is enough for me to say, "Nope." Hopefully an expert (not an armchair cyber guy) can change my mind.

[@Kaiyats]

You can store passkeys on most password managers too so you’ll be fine

[@Deron_mataz]

You have options

[@HAAFz07]

best

[@herculeswendling2779]

😊

[@user-wl6qe7cd6z]

FF

[@Glorydavid248]

Hellw brother I need you help some one from urp she trak my phone

[@user-nm6rp3ml9m]

thank you