Comment by what
5 days ago
Sure. You’re assuming every site will revoke your passkey when that happens though. It also feels like a great time to trick people into registering an attacker passkey instead.
5 days ago
Sure. You’re assuming every site will revoke your passkey when that happens though. It also feels like a great time to trick people into registering an attacker passkey instead.
You would revoke it yourself, I am saying.
Also, the same risk applies, but to an even greater degree, with a password.
No, it absolutely doesn’t apply the same way to password. In a PQ world anyone that has your public key also has your private key. That’s not the case with a password and stolen hash.
In a PQ world if they have the stolen hash, they have the password. How is that different than the passkey world?
2 replies →