Post #1579197

2026-02-28 23:33 UTC

Yeah, I see what you’re saying. As far as I am aware, passkeys issue a one-time-token derived from a private key stored on the device. You can only access the private key via your devices own security (i.e., typically biometric). GitHub can only access the resulting one-time token, and it can verify that the token was derived from the private key using some cryptography. So, agreed. It’s not much different from a tracking perspective than just tracking password-based logins. Though, I got the impression OP was talking about something else. Maybe I misunderstood them.

Replies (1)

@ricecake@sh.itjust.works 2026-03-01 00:05

That's close enough for a privacy perspective. There's also limitations on domains that can request the auth, specifically ”only the one the credential is for", and there's a different key per domain and user typically. It's also implemented in a way where if the user doesn't choose to disclose their account to the service, the service can't know. Caring about privacy and caring about the details of a security protocol are distinct. You'd be surprised how many people who care about privacy are deeply wary of passkeys because of the biometric factor, which is unfortunate because the way it authenticates is a lot harder to track across domains by design. I understood they had a lot of concerns, one of which was biometrics via passkeys since GitHub was a very early adopter due to the supply chain risk they pose.

Open ##1579198