Signing back into the Community for the first time? You'll need to reset your password to access your account. Find out more.
Forum Discussion
datx
2 years agoNew Contributor
What am I missing with passkeys?
I am finally getting around to putting passkeys into action.. but something isn't adding up.
As a low risk test, I added a passkey to a bestbuy account. Started up an incognito session, and logge...
Former Member
2 years agoFor those that are a bit more security conscious (which I think most of us are, seeing how we are all here), I am not convinced that passkeys are necessarily more secure. For instance, if someone has a 30-char password (using 1Password) with Yubikey as a multi-factor, is that not more secure?
There is, in fact, one huge difference between passkeys and a 30-char password. Traditional passwords are symmetric -- both sides have to store/know the original password. Technically the server can and should store just a hash of the password, however 1) this (sadly) doesn't always happen and 2) there are potential issues with that as well, such as a hash search. Passkeys on the other hand are asymmetric. The server stores the matching public key to your private key. And the login process doesn't even exchange the actual keys. If somehow a hacker is able to get their hands on your public key because of a hack on the company side, there is zero chance that they can use that to login as you there or anywhere else. (Of course if they hacked into the entire company's back-end, it doesn't even matter. But it is often the case that databases of password data are hacked or leaked without a full corporate compromise.)