Home | Notifications | New Note | Local | Federated | Search | Logout
Note Detail
Reply to @shaoyu@mastodon.social
Filippo Valsorda@filippo@abyssdomain.expert (2026-07-22 11:36:06)
@shaoyu passkeys can't be phished.
---Reply---
Shaoyu@shaoyu@mastodon.social (2026-07-22 11:52:34)
@filippo Thanks for the explanation, it would be valuable if there's a more detailed education on why passwd[:32] can be phished, while passwd[32:] is immune
Reply
---Replies---
ori@ori@hj.9fs.net (2026-07-22 12:01:24)
It's public key cryptography, not a simple password. The private data is not sent over the wire, so it can't be stolem. I would like to have public key cryptography in use for authentication, though I have one major and one minor reservation with passkeys.
The major reservation is remote attestation: the party that I'm authenticating with should have no idea what device I'm using, as long as it follows protocol. I don't feel comfortable using a protocol with provisions for this; large tech companies have shown that they're not to be trusted, especially where there's an opportunity for lock-in.
The minor reservation is the difficulty of backup and recovery. (If the major reservation is resolved, I can run a non-standard passkey agent that backs up the way I want, so this is only an issue if someone has protocol support for constraining the devices I can use)
CC: @filippo@abyssdomain.expert @shaoyu@mastodon.social