Re: OT: Passkey usage

On Sat, 2026-08-15 at 00:21 +0930, Tim via users wrote:
> On Fri, 2026-08-14 at 11:29 +0100, Patrick O'Callaghan wrote:
> > It's better than a password because (in theory) it never leaves the
> > device, and hence is not vulnerable to an eavesdropper. Think of it
> > as
> > one half of an asymmetric key pair.
> 
> As long as the system isn't weak against replay of a certificate
> (something listens to yours, copies it, then sends the same thing to
> a
> bad system to impersonate you).  It shouldn't be possible, there's
> supposed to be cross-checking, and maths that do something unique
> each
> time you use your credentials, but some badly designed systems have
> failed that way.

As the passkey is never sent over the wire, there's nothing to copy.
The server sends a unique one-time challenge which the device signs
using the private key. The server verifies the signature using the
stored public key in order to authenticate the device.

The potential weakness is when the private key store itself is not
secure. Ideally, it should be in a secure hardware enclave. e.g. a TPM
or similar on the device, or a hardware token such as a Yubikey, but
this makes it impossible to copy. Since people usually want to be able
to log in from multiple devices and no-one wants to have to register
each device independently, this creates a problem, so often the
"enclave" is actually cloud storage. This is similar to many password
managers (the majority of which now also support passkeys), with the
difference that no amount of password guessing or eavesdropping is
going to work as an attack.

As often happens, there's a balance between security and convenience.

poc
-- 
_______________________________________________
users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new