Post #2731744
2026-05-19 08:05 UTC
Passkeys are great in that they are public key authentication made easy. I wonder though if there's a reason that it doesn't seem possible to use the same keypair on many different sites. Is that meant to contain the damage if a key is compromised, or to protect privacy?
Replies (2)
-
@radex@social.hackerspace.pl 2026-05-19 09:39
@seanreilly@mastodon.social with a regular password manager, you can fool someone into giving credentials to another website. My *guess* is that passkey designers wanted to avoid that. This also forces website authors to stop changing the login page url every few years (which is how even a sophisticated user can get fooled with a typosquat domain or something)
-
@mrwalker@mastodon.social 2026-05-22 19:40
@seanreilly@mastodon.social I think we discussed this as a concept at least a decade ago! I love that it’s happening, and that people who think more about security than we do are on it.