Post #3972480

2026-07-20 23:25 UTC

Passkeys can be stored just like password hashes! I'm proposing an interoperable $webauthn$v=1$… format, and a Go API that uses these passkey records for authentication. I'm looking for feedback before proposing this as crypto/passkey for Go 1.28! https://words.filippo.io/passkey-record/

Replies (4)

@bob_zim@infosec.exchange 2026-07-21 03:46

@filippo@abyssdomain.expert That all sounds very reasonable. Some site operators have implemented passkeys alarmingly poorly, I suspect due to a lack of understanding of how sites should handle the public key. Explicitly treating them just like credentials people already know how to store should help clarify it.

Open ##3976366
@synlogic4242@social.vivaldi.net 2026-07-20 23:38

@filippo@abyssdomain.expert I'd like to see passkeys get broader adoption. the UX needs to beat both passwords and ssh-style pub/priv key pairs

Open ##3995400
@fazalmajid@social.vivaldi.net 2026-07-21 07:19

@filippo@abyssdomain.expert Since many data models only support one row in the credentials table, it might be a good idea to allow multiple passkeys, or create a new scheme multi-webauth that encapsulates multiple passkeys.

Open ##3995414
@shaoyu@mastodon.social 2026-07-22 00:42

@filippo@abyssdomain.expert I wonder if it's Ok to ask a basic question, what do passkeys provide in which passwords don't? In principle, it looks like passwords are passwd[:32] and passkeys are passwd[32:]?

Open ##4002293