A new login technique is becoming available in 2023: the passkey. The passkey promises to solve phishing and prevent password reuse. But lots of smart and security-oriented folks are confused about what exactly a passkey is. There’s a good reason for that. A passkey is in some sense one of two (or three) different things, depending on how it’s stored.
  • meteokr@community.adiquaints.moe
    3·
    8 months ago

    When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.

    Very small correction as I understand, but your private key is never presented. The web service should never interact with the private key directly. Your device is signing some bit of data, then the server uses your public key to verify that it was signed by your private key. Its a small distinction, but is one of the principal uses of asymmetric encryption is that the public key can truly be public knowledge and given to anyone, while the private key is 100% always only accessed by you the user.

    • Natanael@slrpnk.net
      2·
      8 months ago

      Yeah, the TPM should perform the signature inside of the security chip, the key is always off limits from everything else