←back to thread

225 points Terretta | 1 comments | | HN request time: 0.203s | source
Show context
taeric ◴[] No.41863484[source]
I'm super curious how this will ultimately work. As noted in another thread, secure enclaves aren't secure if they can be copied. Such that, if this is moving the passkey by copying it, I'm not at all clear on how that stays secure?
replies(4): >>41863618 #>>41866813 #>>41867580 #>>41894895 #
Scion9066 ◴[] No.41863618[source]
Generally this spec is talking about the kind of passkeys that are stored in password managers, not the kinds used by hardware security keys. Those in a password manager have always been technically copyable somehow, there just wasn't a standard format or protocol for doing so.
replies(1): >>41863662 #
taeric ◴[] No.41863662[source]
I knew that "passkey" had grown to refer to a set of different things. I can't say this upsets me, as it does sound like progress over the old status quo. Still, is confusing for those of us that bought in at the beginning.
replies(2): >>41864470 #>>41864840 #
1. mjs ◴[] No.41864840[source]
The Yubico FAQ explains some of the history fairly well: https://www.yubico.com/blog/a-yubico-faq-about-passkeys/

In particular, they distinguish between "copyable" and "hardware-bound" passkeys. They're both passkeys, and can be used wherever passkeys are supported, but only the "hardware-bound" passkeys support attestation.