James House-Lantto (He/Him)

https://proton.me/blog/passkey-vs-password

Proton does a pretty through breakdown of the differences, pros, and cons of Passkeys vs Passwords.

#Proton #Password #Passkey #Privacy #Security

Passkey vs password: What is the difference? | Proton

Discover how passkeys work, why they beat passwords on security and usability, and when you still need a password.

Proton
Mar 23 at 5:27pmWeb
Show threadiinuwa2d ago

@Theeo123 this is pretty good, but I think the opening paragraph ties #passkeys too closely to the biometric factor. That has two issues:

1. Biometrics are not required to use passkeys; it is a convenience factor. A device PIN or password manager master password can also be used to protect the keys. Some misunderstand passkeys to send fingerprints to websites, and repeating "passkeys = fingerprint" can make that confusion worse.

Show threadiinuwa2d ago
@Theeo123 2. It sticks too closely to the multi-factor language, as if multiple factors is the goal of an authentication ceremony. The goal is assurance of the user's identity, and multi-factor ceremonies are one way to do this. But the real killer features of passkeys are the asymmetric crypto and browser integration. If the user's browser is trustworthy, then the website can have guarantees about the context of the auth session.
Show threadiinuwa2d ago
@Theeo123 This confidence in the user context isn't captured in the "which #2fa factors do #Passkeys have" discussion, and I would love to see this part elevated more in the discourse about them.