Comment by cowlevel
5 days ago
Here's one way to screw it up: make the public key the password. Normally only the user and the site know the user's public key for a given site, so it's as secure as a password, and nobody notices the problem.
5 days ago
Here's one way to screw it up: make the public key the password. Normally only the user and the site know the user's public key for a given site, so it's as secure as a password, and nobody notices the problem.
I don't know how you could screw that up and not break the UX flow in a way that would have some sort of noticeable hiccup, given the Webauthn API as it has been standardized. The response to a Passkey challenge includes only a short fingerprint or "unique name" of the public key, not the full public key. Off the top of my head I think you only see the full public key in registration steps, and then if you try to re-register a key most Passkey implementations are going to enroll an entirely different key.
I'm sure that there are big enough fools out there, I'm just thinking there might be signs they are doing something wrong in that case.