|
| ▲ | kodt 2 days ago | parent | next [-] |
| The difference is you can't just copy and paste the private key into a phishing website. The login process validates your private key and logs you in. Also since the service does not store your private key, it is more resistant to data-breaches as that is one less potential breach source. |
| |
| ▲ | RHSeeger a day ago | parent [-] | | But most password programs do this too, if you install the plugin (which you pretty much need if you want those same programs to do the passkey thing, anyways) |
|
|
| ▲ | BadBadJellyBean 2 days ago | parent | prev | next [-] |
| They are bigger. Not as easy to guess. More like pretty impossible. It's like not letting the user choose the password. That way they can't have a bad password. |
| |
| ▲ | RHSeeger a day ago | parent | next [-] | | It is relatively easy to pick a password length/composition that's pretty much impossible to guess, too. So the benefit you're list is for the company (that has to deal with people picking bad passwords), not the person using their site. Heck, the company could easily say that your password needs to be 128 characters long and use multiple types of characters - and tell you to use a password manager (that both generates and fills in that information for yet). | |
| ▲ | Aerroon 2 days ago | parent | prev [-] | | But these same services are the reason why my passwords are as short as they are. They made me use 'short passwords' by putting upper limits on them. |
|
|
| ▲ | Marsymars 2 days ago | parent | prev [-] |
| Main difference is that my banking website doesn't make me use SMS 2FA if I use a passkey to log in. |