“Passkeys,” the secure authentication mechanism built to replace passwords, are getting more portable and easier for organizations to implement thanks to new initiatives the FIDO Alliance announced on Monday.

  • @[email protected]
    link
    fedilink
    English
    462 months ago

    If you tell corporations there’s a way to increase lock-in and decrease account sharing, they’re gonna make it work.

    • umami_wasabi
      link
      fedilink
      English
      252 months ago

      One is a new technical specification called Credential Exchange Protocol (CXP) that will make passkeys portable between digital ecosystems, a feature that users have increasingly demanded.

      I.e. I can copy my key to my friends’ device.

        • @[email protected]
          link
          fedilink
          English
          92 months ago

          Read the article, it’s literally about replacing Import/Export CSV plaintext unencrypted files with something more secure.

          I.e. moving your passwords/passkeys between password managers. This is not about replacing stuff like OAuth where one service securely authorizes a user for another.

        • trevor
          link
          fedilink
          English
          62 months ago

          It’s gonna work with KeePass and Bitwarden once it’s finalized.

        • umami_wasabi
          link
          fedilink
          English
          8
          edit-2
          2 months ago

          That’s not how Passkey, and the underlying WebAuthn works.

          (Highly simplifies but still a bit technical) During registration, your key and the service provider website interacts. Your key generated a private key locally that don’t get sent out, and it is the password you hold. The service provider instead get a puclic key which can be used to verifiy you hold the private key. When you login in, instead of sending the private key like passwords, the website sent something to your key, which needs to be signed with the private key, and they can verify the signature with the public key.

          The CXP allows you export the private key from a keystore to another securely. Service providers (Netflix) can’t do anything to stop that as it doesn’t hold anything meaningful, let alone a key (what key?), to stop the exchange.