Comment by what
5 days ago
No, it absolutely doesn’t apply the same way to password. In a PQ world anyone that has your public key also has your private key. That’s not the case with a password and stolen hash.
5 days ago
No, it absolutely doesn’t apply the same way to password. In a PQ world anyone that has your public key also has your private key. That’s not the case with a password and stolen hash.
In a PQ world if they have the stolen hash, they have the password. How is that different than the passkey world?
What? No? That’s not how hashing works. Thank you for confirming that you have no idea what you’re talking about.
Yeah, you are right. I don't know what I was thinking when I said that.
Little harsh to say I have NO idea what I am talking about, though.
I still don't agree that companies won't revoke their passkeys if we are in a PQ world.
If they don't, you are still in a better place than passwords. Each public/private key pair is unique for every domain, so a compromise in one place is not a compromise in others. Many people re-use passwords (even if you don't).