I keep saying that nobody knows what they are doing with passkeys.
The documentation is marketing material like some altcoin whitepaper.
The Wikipedia article is already wrong in the first paragraphs.
this post was submitted on 13 Nov 2025
63 points (100.0% liked)
news
24524 readers
748 users here now
Welcome to c/news! We aim to foster a book-club type environment for discussion and critical analysis of the news. Our policy objectives are:
-
To learn about and discuss meaningful news, analysis and perspectives from around the world, with a focus on news outside the Anglosphere and beyond what is normally seen in corporate media (e.g. anti-imperialist, anti-Zionist, Marxist, Indigenous, LGBTQ, people of colour).
-
To encourage community members to contribute commentary and for others to thoughtfully engage with this material.
-
To support healthy and good faith discussion as comrades, sharpening our analytical skills and helping one another better understand geopolitics.
We ask community members to appreciate the uncertainty inherent in critical analysis of current events, the need to constantly learn, and take part in the community with humility. None of us are the One True Leftist, not even you, the reader.
Newcomm and Newsmega Rules:
The Hexbear Code of Conduct and Terms of Service apply here.
-
Link titles: Please use informative link titles. Overly editorialized titles, particularly if they link to opinion pieces, may get your post removed.
-
Content warnings: Posts on the newscomm and top-level replies on the newsmega should use content warnings appropriately. Please be thoughtful about wording and triggers when describing awful things in post titles.
-
Fake news: No fake news posts ever, including April 1st. Deliberate fake news posting is a bannable offense. If you mistakenly post fake news the mod team may ask you to delete/modify the post or we may delete it ourselves.
-
Link sources: All posts must include a link to their source. Screenshots are fine IF you include the link in the post body. If you are citing a Twitter post as news, please include the Xcancel.com (or another Nitter instance) or at least strip out identifier information from the twitter link. There is also a Firefox extension that can redirect Twitter links to a Nitter instance, such as Libredirect or archive them as you would any other reactionary source.
-
Archive sites: We highly encourage use of non-paywalled archive sites (i.e. archive.is, web.archive.org, ghostarchive.org) so that links are widely accessible to the community and so that reactionary sources don’t derive data/ad revenue from Hexbear users. If you see a link without an archive link, please archive it yourself and add it to the thread, ask the OP to fix it, or report to mods. Including text of articles in threads is welcome.
-
Low effort material: Avoid memes/jokes/shitposts in newscomm posts and top-level replies to the newsmega. This kind of content is OK in post replies and in newsmega sub-threads. We encourage the community to balance their contribution of low effort material with effort posts, links to real news/analysis, and meaningful engagement with material posted in the community.
-
American politics: Discussion and effort posts on the (potential) material impacts of American electoral politics is welcome, but the never-ending circus of American Politics© Brought to You by Mountain Dew™ is not welcome. This refers to polling, pundit reactions, electoral horse races, rumors of who might run, etc.
-
Electoralism: Please try to avoid struggle sessions about the value of voting/taking part in the electoral system in the West. c/electoralism is right over there.
-
AI Slop: Don't post AI generated content. Posts about AI race/chip wars/data centers are fine.
founded 5 years ago
MODERATORS
Isn't it similar to key based authentication when using ssh?
Do you think this could have happened if passkeys were like ssh key based auth?
I can give a longer explanation later if you want.
Ok I read the "Whitepaper" and I still don't really understand what the difference is. The server stores your public key and uses that key to encrypt a challenge message that is sent to your device, which you then use your private key to decrypt to prove your identity. This is tied to the domain that the key was created on. That's the only real difference I can see here and the least explained part of the white paper. HOW is it bound to the domain address? If the domain address of the server I'm trying to SSH into changes and I try to connect to the old address, obviously it fails, but I probably know the new address. If I attempt to connect to the new address, I'll be provided a signature for the server I'm connecting to, and then it would attempt the key challenge for authentication.
So is the domain address used in some silly way with passkeys that causes the key pair to become invalid? It reminds me of the issues with changing your domain on Lemmy, where you can't convince the federated instances that this new domain is a continuation of the old domain because I think the old domain is used as part of the cryptographic process, and so when it changes, any authentication attempts from the new domain fail.
Which white paper are you referencing? Ive been meaning to read up on this.
This is the one I was refrencing: https://fidoalliance.org/white-paper-replacing-password-only-authentication-with-passkeys-in-the-enterprise/
But then there is also this one that I just saw in the search results, might have more information the above was lacking: https://www.onespan.com/sites/default/files/2025-11/OneSpan-White-Paper-Passkey-Security.pdf
Thanks! Really appreciate it
Well, naturally, if it was like ssh, it probably wouldn't have happened. I'll take a write-up if you feel up for it, but I can also look up the whitepaper too.
I am also interested in a longer explanation if you have the time!
A public service
eX.
Very cool.
X (formerly known as Twitter)
X (formerly known as Twitter)
X (formerly known as Twitter)
X (formerly known as Twitter)
X (formerly known as Twitter)
X (formerly known as Twitter)
X (formerly known as Twitter)
X (formerly known as Twitter)
im sure you can get away with either calling it twitter or mentioning it was twitter only once. did they find and replace this shit?
the article just calls it X, OP added that lol