<story><title>Passkeys: The beginning of the end of the password</title><url>https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/</url></story><parent_chain><item><author>__MatrixMan__</author><text>Why not call it a private key then, we&amp;#x27;ve been handling those since the 70&amp;#x27;s.&lt;p&gt;They don&amp;#x27;t need to be rebranded, they need to be taught in high school with the same words we&amp;#x27;ve always used to talk about them.</text></item><item><author>mk89</author><text>You need to click on the link that is in the post: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.google&amp;#x2F;technology&amp;#x2F;safety-security&amp;#x2F;one-step-closer-to-a-passwordless-future&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.google&amp;#x2F;technology&amp;#x2F;safety-security&amp;#x2F;one-step-clos...&lt;/a&gt;&lt;p&gt;&amp;gt; Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone.&lt;p&gt;It looks like a token stored on your phone that will be used instead of your password to authenticate.&lt;p&gt;Apple did something similar: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;passkeys&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;passkeys&amp;#x2F;&lt;/a&gt; that is automatically sync-ed in iCloud Keychain, so on every apple device you own, you can use it.&lt;p&gt;More information here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;passkeys&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;passkeys&amp;#x2F;&lt;/a&gt; and this explains finally how it works FIDO in general: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;how-fido-works&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;how-fido-works&amp;#x2F;&lt;/a&gt;&lt;p&gt;So yeah it&amp;#x27;s &lt;i&gt;sort of&lt;/i&gt; a token, but technically, it&amp;#x27;s a private key that is used to sign the challenge at login time.&lt;p&gt;EDIT: from what I understand, while this prevents from &amp;quot;stealing passwords&amp;quot; etc., there is still the risk that someone steals your private key (copy&amp;#x2F;paste your phone or ... well, steals stuff from iCloud Keychain) and tries to use that to sign the challenge. Did I get it right? Or what mechanism is in place to prevent it? It looks like this time we use biometrics first (to unlock the screen) and passkey later?</text></item><item><author>jimmar</author><text>The paragraph in the section, &amp;quot;What are passkeys?&amp;quot; tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn&amp;#x27;t tell me what passkeys actually are.&lt;p&gt;Compare passkeys to traditional authentication factors. What&amp;#x27;s a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or retina. What are hardware tokens? They are physical devices that give you codes that verify that the person logging in has the device on their person.&lt;p&gt;What are passkeys?&lt;p&gt;Until they develop a way to explain what passkeys really are, I question how quickly they will be adopted.</text></item></parent_chain><comment><author>dwaite</author><text>It isn&amp;#x27;t (just) a private key. It is part of a purpose-built authentication process that leverages private keys as a component.&lt;p&gt;You cannot use the private key within a passkey for general purpose data signing, for example.</text></comment>
<story><title>Passkeys: The beginning of the end of the password</title><url>https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/</url></story><parent_chain><item><author>__MatrixMan__</author><text>Why not call it a private key then, we&amp;#x27;ve been handling those since the 70&amp;#x27;s.&lt;p&gt;They don&amp;#x27;t need to be rebranded, they need to be taught in high school with the same words we&amp;#x27;ve always used to talk about them.</text></item><item><author>mk89</author><text>You need to click on the link that is in the post: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.google&amp;#x2F;technology&amp;#x2F;safety-security&amp;#x2F;one-step-closer-to-a-passwordless-future&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.google&amp;#x2F;technology&amp;#x2F;safety-security&amp;#x2F;one-step-clos...&lt;/a&gt;&lt;p&gt;&amp;gt; Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone.&lt;p&gt;It looks like a token stored on your phone that will be used instead of your password to authenticate.&lt;p&gt;Apple did something similar: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;passkeys&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;passkeys&amp;#x2F;&lt;/a&gt; that is automatically sync-ed in iCloud Keychain, so on every apple device you own, you can use it.&lt;p&gt;More information here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;passkeys&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;passkeys&amp;#x2F;&lt;/a&gt; and this explains finally how it works FIDO in general: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;how-fido-works&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fidoalliance.org&amp;#x2F;how-fido-works&amp;#x2F;&lt;/a&gt;&lt;p&gt;So yeah it&amp;#x27;s &lt;i&gt;sort of&lt;/i&gt; a token, but technically, it&amp;#x27;s a private key that is used to sign the challenge at login time.&lt;p&gt;EDIT: from what I understand, while this prevents from &amp;quot;stealing passwords&amp;quot; etc., there is still the risk that someone steals your private key (copy&amp;#x2F;paste your phone or ... well, steals stuff from iCloud Keychain) and tries to use that to sign the challenge. Did I get it right? Or what mechanism is in place to prevent it? It looks like this time we use biometrics first (to unlock the screen) and passkey later?</text></item><item><author>jimmar</author><text>The paragraph in the section, &amp;quot;What are passkeys?&amp;quot; tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn&amp;#x27;t tell me what passkeys actually are.&lt;p&gt;Compare passkeys to traditional authentication factors. What&amp;#x27;s a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or retina. What are hardware tokens? They are physical devices that give you codes that verify that the person logging in has the device on their person.&lt;p&gt;What are passkeys?&lt;p&gt;Until they develop a way to explain what passkeys really are, I question how quickly they will be adopted.</text></item></parent_chain><comment><author>esquivalience</author><text>Why not call passwords private words? We&amp;#x27;ve been using words even longer.&lt;p&gt;The answer is that they&amp;#x27;re being used to pass an authentication challenge. Pass + key is no different.</text></comment>