Comment by mpyne
7 days ago
> There is virtually no difference to writing down a password on a piece of paper. Well, I guess a passkey is a lot longer than the avg password.
The big difference is not just that a passkey is a private key, it's that the server you register the passkey within holds only the corresponding public key. They don't have a copy of your password (long or otherwise), not even a hashed version of it that could be recovered from a password database dump of the server.
This is a big improvement compared to the days of having your "strong password" end up on the dark web somewhere.
Yeah, I was only talking about differences for backup.
As long as no attestation is used, you only have to store the private key, credentialId and userHandle (basically the server generated ids of the passkey and the user). That's not to different to writing down username and password.