Big Tech companies want to chain your passkey to their products. Enter Proton Pass, which allows you to manage and use passkeys across all devices seamlessly.
  • Big Tech has implemented passkeys in a way that locks users into their platforms rather than providing universal security
  • Passkeys were developed to replace passwords for better account security, but their rollout by Apple and Google has limited their potential
  • Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
      • hydration9806English
        3·
        vor 9 Monaten

        Passkey = Resident Key

        Nonresident keys are not passkeys, they are solely a second form of authentication meaning the service you are logging into still requires a password.

        • Spotlight7573@lemmy.worldEnglish
          1·
          vor 9 Monaten

          Couldn’t a site theoretically use a nonresident key with just a username, in place of a password?

          This seems to imply it might be possible:

          https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Resident_Keys.html

          Discoverable Credential means that the private key and associated metadata is stored in persistent memory on the authenticator, instead of encrypted and stored on the relying party server. If the credentials were stored on the server, then the server would need to return that to the authenticator before the authenticator could decrypt and use it. This would mean that the user would need to provide a username to identify which credential to provide, and usually also a password to verify their identity.

          • hydration9806English
            1·
            vor 9 Monaten

            For sure, but that still isn’t a passkey. The method you are talking about is the equivalent of non-passphrase protected SSH protocol, which is a single form of authentication (i.e. if someone has your security key they have your account).

            The term passkey implies MFA: having a physical key and a password, a physical key and a fingerprint scan, or equivalent.

            Sure the username could be considered the password, but usernames are not designed to be protected the same way. For example, they typically are stored in clear text in a services database, so one databreach and it’s over.

    • BeatTakeshi@lemmy.worldEnglish
      1917·
      vor 9 Monaten

      How is 25 bad? Do you need a passkey for each service /app/website? Can’t you use the same key for many services? (trying to understand how they work)

      • lemmyvore@feddit.nlEnglish
        18·
        vor 9 Monaten

        Ideally yes, they’re supposed to eventually replace all passwords. Of which I have hundreds. And yes not 100% of them will do that on the near future but a lot more than 25 will.

      • CriticalMiss@lemmy.worldEnglish
        9·
        vor 9 Monaten

        I have 150 passwords in my password manager. I’m not buying 7 YubiKeys (and to be fair that’s not what they’re designated for)

        • capital@lemmy.worldEnglish
          4·
          vor 9 Monaten

          Being down-voted for asking questions is bullshit. Your questions are valid and those people suck.

      • Natanael@slrpnk.netEnglish
        3·
        vor 9 Monaten

        You only need one per website if you want it to autofill the username, because resident keys held on the security token can be recognized and suggested automatically but otherwise you must first enter your username on the website and let the website send its challenge value for the corresponding domain and account pair so that your security token can respond correctly.

      • paraphrand@lemmy.worldEnglish
        3·
        vor 9 Monaten

        Having a key shared across sites wouldn’t be great. If it was great it would be an article talking about “passkey” not “passkeys” because you would just have one. Like some sort of Skeleton Passkey that unlocks all your shit when compromised.

      • laughterlaughter@lemmy.worldEnglish
        63·
        vor 9 Monaten

        No, sharing passkeys across services is way too risky. One service gets compromised, someone gets your passkey, and then they have access to all of your services. It’s the same principle with regular passwords.

        • Spotlight7573@lemmy.worldEnglish
          71·
          vor 9 Monaten

          Uh, each service only has access to your public key, not the private one that stays with you. It’s less risky than a regular password.

          Even with U2F hardware keys where the server-side stores the encrypted key (to allow for infinite sites to be used with a single hardware key), it’s only decryptable on your key and thus isn’t that useful for someone who has compromised a service.