Big Tech companies want to chain your passkey to their products. Enter Proton Pass, which allows you to manage and use passkeys across all devices seamlessly.
  • Big Tech has implemented passkeys in a way that locks users into their platforms rather than providing universal security
  • Passkeys were developed to replace passwords for better account security, but their rollout by Apple and Google has limited their potential
  • Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
  • Spotlight7573@lemmy.worldEnglish
    0·
    1 year ago

    Couldn’t a site theoretically use a nonresident key with just a username, in place of a password?

    This seems to imply it might be possible:

    https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Resident_Keys.html

    Discoverable Credential means that the private key and associated metadata is stored in persistent memory on the authenticator, instead of encrypted and stored on the relying party server. If the credentials were stored on the server, then the server would need to return that to the authenticator before the authenticator could decrypt and use it. This would mean that the user would need to provide a username to identify which credential to provide, and usually also a password to verify their identity.