Comment by cortesoft
5 days ago
In a PQ world if they have the stolen hash, they have the password. How is that different than the passkey world?
5 days ago
In a PQ world if they have the stolen hash, they have the password. How is that different than the passkey world?
What? No? That’s not how hashing works. Thank you for confirming that you have no idea what you’re talking about.
Yeah, you are right. I don't know what I was thinking when I said that.
Little harsh to say I have NO idea what I am talking about, though.
I still don't agree that companies won't revoke their passkeys if we are in a PQ world.
If they don't, you are still in a better place than passwords. Each public/private key pair is unique for every domain, so a compromise in one place is not a compromise in others. Many people re-use passwords (even if you don't).