Hacker News Reader

Comment by Freak_NL | Hacker News Reader

For anyone else familiar with WebAuthn but confused about the generic term 'passkey' like I was: the author is probably talking about some new Apple feature for IOS. It looks just like regular WebAuthn from what I can tell.

View on HN

This is a joint development announced by Apple, FIDO, Google, and Microsoft. Passkeys follow the WebAuthn standard but add the functionality of working cross-device without needing to re-enroll and allow one device to authenticate for another near by device (ie phone authenticating log in attempt on laptop).

https://fidoalliance.org/apple-google-and-microsoft-commit-t...

If you’re familiar with U2F and FIDO2 MFA, Adam Langley’s interview on the “Security, Cryptography, Whatever” podcast is worth listening to for the discussion of what’s happened since and the thinking behind many of the decisions:

https://securitycryptographywhatever.buzzsprout.com/1822302/...

Yes, it is WebAuthn + iCloud storage of the client credentials.

Note that Microsoft and Google also agreed to the Passkey terminology and will be adopting it in all their Webauthn-related UIs

Being very pedantic: "passkey" is spelt with a lowercase "p" like with "password".

Also, there is a draft being working on for credentials transfer:

   This document describes a mechanism to transfer digital credentials
   securely between two devices.  Secure credentials may represent a
   digital key to a hotel room, a digital key to a door lock in a house
   or a digital key to a car.  Devices that share credentials may belong
   to the same or two different platforms (e.g. iOS and Android).
   Secure transfer may include one or more write and read operations.
   Credential transfer needs to be performed securely due to the
   sensitive nature of the information.

* https://datatracker.ietf.org/doc/html/draft-secure-credentia...

Reply on news.ycombinator.com