Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Filippo Valsorda@filippo@abyssdomain.expert (2026-07-21 08:25:04)
Passkeys can be stored just like password hashes!

I'm proposing an interoperable $webauthn$v=1$… format, and a Go API that uses these passkey records for authentication.

I'm looking for feedback before proposing this as crypto/passkey for Go 1.28!

https://words.filippo.io/passkey-record/
---Reply---
Shaoyu@shaoyu@mastodon.social (2026-07-22 09:42:29)
@filippo I wonder if it's Ok to ask a basic question, what do passkeys provide in which passwords don't? In principle, it looks like passwords are passwd[:32] and passkeys are passwd[32:]?

---Replies---

Filippo Valsorda@filippo@abyssdomain.expert (2026-07-22 11:36:06)
@shaoyu passkeys can't be phished.