Technology

59989 readers

2308 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

189

The War on Passwords Is One Step Closer to Being Over (www.wired.com)

submitted 2 months ago by GreenEngineering3475@lemmy.world to c/technology@lemmy.world

134 comments fedilink hide all child comments

“Passkeys,” the secure authentication mechanism built to replace passwords, are getting more portable and easier for organizations to implement thanks to new initiatives the FIDO Alliance announced on Monday.

you are viewing a single comment's thread
view the rest of the comments

[–] umami_wasbi@lemmy.ml 24 points 2 months ago (2 children)

One is a new technical specification called Credential Exchange Protocol (CXP) that will make passkeys portable between digital ecosystems, a feature that users have increasingly demanded.

I.e. I can copy my key to my friends' device.

[–] rickdg@lemmy.world 10 points 2 months ago (2 children)

I believe that’s Apple talking to Google, not anything local you can own.

[–] 4am@lemm.ee 9 points 2 months ago

Read the article, it’s literally about replacing Import/Export CSV plaintext unencrypted files with something more secure.

I.e. moving your passwords/passkeys between password managers. This is not about replacing stuff like OAuth where one service securely authorizes a user for another.

[–] trevor@lemmy.blahaj.zone 6 points 2 months ago (1 children)

It's gonna work with KeePass and Bitwarden once it's finalized.

[–] rickdg@lemmy.world 3 points 2 months ago

I’d love to see that.

[+] _bcron_@lemmy.world -1 points 2 months ago* (last edited 2 months ago) (1 children)

[deleted]

[–] umami_wasbi@lemmy.ml 9 points 2 months ago* (last edited 2 months ago) (2 children)

That's not how Passkey, and the underlying WebAuthn works.

(Highly simplifies but still a bit technical) During registration, your key and the service provider website interacts. Your key generated a private key locally that don't get sent out, and it is the password you hold. The service provider instead get a puclic key which can be used to verifiy you hold the private key. When you login in, instead of sending the private key like passwords, the website sent something to your key, which needs to be signed with the private key, and they can verify the signature with the public key.

The CXP allows you export the private key from a keystore to another securely. Service providers (Netflix) can't do anything to stop that as it doesn't hold anything meaningful, let alone a key (what key?), to stop the exchange.

[–] radiohead37@lemmynsfw.com 4 points 2 months ago (1 children)

So basically cert exchange when you want to ssh without passwords?

[–] shortwavesurfer@lemmy.zip 4 points 2 months ago

Pretty much, yeah.

[–] wingsfortheirsmiles@feddit.uk 2 points 2 months ago

Thanks for this, from a non techie