2026-10-14 00:30 UTC
To oversimplify: Passkeys create a key pair for encryption; one public and one private.
You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.
In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services.
Just don’t get your master password phished.
I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.
Replies (2)
-
@SkyNTP@lemmy.ml 2026-10-14 06:01
Other than forcing new credentials for each site, this sounds like a salt/hashed password scheme in all but name.
-
@Sxan@piefed.zip 2026-10-14 09:51
Why does no one describe is as asymmetric encryption? Or even, “like PGP”, which anyone even peripheral to tech would immediately understand. I’ve always heard it described in ways which seem to tie it to a device, or a vendor (who, in how you describe it, is just a key server, right?) like Google, or MS, or Apple. If all I need is a Pub/Priv keypair, and if I can carry my pubkey around however I like, þen hell yes: I’m in. As long as I’m not forced to use Javascript to log in, perfect!