Post #1579196
2026-02-28 22:52 UTC
I know how device fingerprinting works, thank you though.
>You don't need my fingerprint, hardware or personal, or biometric shit.
To me that sounds like hardware identifiers, but also quite specifically the things passkeys use. Hence I mentioned it as aside from their main point, which was "don't track me", because the biometrics GitHub or any website is going to ask you to use *can't* be used for that.
Replies (1)
-
@partofthevoice@lemmy.zip 2026-02-28 23:33
Yeah, I see what you’re saying. As far as I am aware, passkeys issue a one-time-token derived from a private key stored on the device. You can only access the private key via your devices own security (i.e., typically biometric). GitHub can only access the resulting one-time token, and it can verify that the token was derived from the private key using some cryptography. So, agreed. It’s not much different from a tracking perspective than just tracking password-based logins. Though, I got the impression OP was talking about something else. Maybe I misunderstood them.