293
Passkeys Explained: The End of Passwords (sentientrant.com)
submitted 10 months ago by to c/technology@lemmy.world
225 comments fedilink hide all child comments
 

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

you are viewing a single comment's thread
view the rest of the comments
[–] 39 points 10 months ago (6 children)

Currently I use a FOSS (I think?) password manager, BitWarden, that supports passkeys. I use it across Mac, Windows and Android so I'm while my passkeys are locked yo the password manager, I am not locked to any of the aforementioned megacorps.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 22 points 10 months ago (2 children)

    While I use and love bitwarden, it's not exactly foss. Although there is a foss implementation of their server backend

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 10 months ago

    A cursory search lead to this thread from 2024 https://community.bitwarden.com/t/concerns-over-bitwarden-moving-away-from-open-source-what-does-our-future-hold/74800

    where an employee stated

    I’ll note that policy wise nothing changed. The referenced issue is a packaging bug, but the goal still is the dual licensing model, with the core being open source, and some (mostly enterprise) features being source-available.

    Both the client and server are mostly open source. Some server features are paywalled. The alternative Vaultwarden server is fully open source, and much lighter on system resources.

    Have there been any recent licensing shenanigans with BitWarden?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 12 points 10 months ago

    KeePassXC has begun rollout of their own implementation, and I’m pretty sure they’re considered FOSS.

    From a quick scan of the white paper, it appears they’re currently using on-device passkey discovery and otherwise “intercepting” passkey registration workflows, which I take to mean they aren’t originating the request as a passkey registrar. This may be the easiest method to satisfy FIDO’s dID requirements.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 10 months ago

    I use BitWarden too. OS , device and browser agnostic is a win

    But I imagine the vast amount of people will use whatever their platform is pushing, so Apple Google or Microsoft. And in 5 years time "3rd party passkeys" are not "secure enough" and blocked by the OS. (Ok that's a bit tinfoil hat, but Google's recent Android app developer verification scheme is fresh in mind)

  • permalink
  • fedilink
  • source
  • parent