Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It depends on who is running your keys for you. Most of the vendors (Apple, Google, Microsoft) are using device-specific (hardware) keys to unlock the passkeys, which generally means that transitively you've first logged in with Face ID, Touch ID, Android Gesture, Windows Hello, PIN or one of the other names or brand names for "device-specific pass code or biometric" that unlocks your device's hardware security enclave.

In your analogy terms it is akin to an SSH key stored on a hardware device like a Yubikey that you have to "push the button" to unlock. It is more secure than just an SSH key without a password, but depending on a lot of factors, including your personal threat model, may be more or less secure than an SSH key with a strong password. (You'd assume the Yubikey's unexportable hardware key is a lot stronger to break than any password, so it is potentially far more secure from brute force attacks, especially remote attacks with no physical access to try to export an unexportable key. It's reliant on physical device security so it is far more weak to "in the room"/"over the shoulder" attacks. At the end of the day most people's threat model is somewhere in the middle of the two extremes.)

Of course if you decide to use a password manager like 1Password or BitWarden those passkeys are going to be locked behind your "master vault password" in a similar way to your other passwords.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: