Privacy

31182 readers

1812 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago

MODERATORS

[email protected]

What are your thoughts on passkey login? (lemmy.world)

submitted 1 month ago by [email protected] to c/[email protected]

11 comments fedilink hide all child comments

A lot of services support passkeys. Microsoft even has an option to make my account "passwordless". Since they are more secure than passwords, will you be switching some / most of your accounts to passkeys any time soon? Interested to hear everyone's thoughts on passkeys. 🔑

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 0 points 1 month ago (1 children)

Passwords can be leaked, mostly by bad security on server side.

Passkeys use secure keys, it checks public keys on both sides and send private key to authenticate, without both keys can't login or if the server is compromised.

It's like GPG or SSH works.

[–] [email protected] 1 points 1 month ago* (last edited 1 month ago) (1 children)

Close but private keys don't get sent.

It sends information encrypted via your public key to your client, then your client proves that it's the real owner of the key by decrypting the message, and then sending a new message back encrypted by the private key that the server can then verify.

This is what's better than a password, the information for providing authentication (the private key) never leaves your computer (where as you almost in all implementations of password based auth, send the password itself to the server).

[–] [email protected] 0 points 1 month ago (1 children)

A question, since you sound like you know what you're talking about. Is this analagous to password-free SSH? I.e., private key used to log in on the basis of a pre-agreed public key?

[–] [email protected] 1 points 1 month ago

Yeah basically. See "What is a passkey" on https://fidoalliance.org/faqs/#PasskeysFAQs

From a technical standpoint, passkeys are FIDO credentials that are discoverable by browsers or housed within native applications or security keys for passwordless authentication. Passkeys replace passwords with cryptographic key pairs for phishing-resistant sign-in security and an improved user experience. The cryptographic keys are used from end-user devices (computers, phones, or security keys) for user authentication.