Post #3990780

@miclgael@hachyderm.io Ultimately, passkeys (and WebAuthn more generally) is asymmetric authentication versus symmetric authentication. Passphrases are passed in the clear—usually over an encrypted transport, but the clear passphrase hits the memory of every service on the path to the authentication service. The authentication service then hashes it and confirms if it matches the stored hash. The clear passphrase can be logged by any of these services, and this has happened many times at some major companies like Google. TOTP and similar no longer passes a clear value, so the webserver may not be able to log your secret, but the authentication service which approves or rejects the codes still has a clear secret in its memory. Fewer places to check for logging, but it’s still possible. With asymmetric authentication, the server never gets secret data. Nothing on that end can possibly log anything which could be used to impersonate you. Though most of the time, this authentication is used to generate a symmetric token stored in a cookie, so cookie stealing or forgery is still potentially a risk.