Big Tech companies want to chain your passkey to their products. Enter Proton Pass, which allows you to manage and use passkeys across all devices seamlessly.
  • Big Tech has implemented passkeys in a way that locks users into their platforms rather than providing universal security
  • Passkeys were developed to replace passwords for better account security, but their rollout by Apple and Google has limited their potential
  • Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
  • @[email protected]English
    3•9 months ago

    Passkey = Resident Key

    Nonresident keys are not passkeys, they are solely a second form of authentication meaning the service you are logging into still requires a password.

    • @[email protected]English
      1•9 months ago

      Couldn’t a site theoretically use a nonresident key with just a username, in place of a password?

      This seems to imply it might be possible:

      https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Resident_Keys.html

      Discoverable Credential means that the private key and associated metadata is stored in persistent memory on the authenticator, instead of encrypted and stored on the relying party server. If the credentials were stored on the server, then the server would need to return that to the authenticator before the authenticator could decrypt and use it. This would mean that the user would need to provide a username to identify which credential to provide, and usually also a password to verify their identity.

      • @[email protected]English
        1•9 months ago

        For sure, but that still isn’t a passkey. The method you are talking about is the equivalent of non-passphrase protected SSH protocol, which is a single form of authentication (i.e. if someone has your security key they have your account).

        The term passkey implies MFA: having a physical key and a password, a physical key and a fingerprint scan, or equivalent.

        Sure the username could be considered the password, but usernames are not designed to be protected the same way. For example, they typically are stored in clear text in a services database, so one databreach and it’s over.