Remix.run Logo
▲ crote 12 hours ago

Passkeys as they are currently-marketed are resident credentials. This means a passkey stored on your Yubikey (or smartphone, or Windows account, or...) is not only a private key, but also contains a UID to identify it. A website doing authentication can trivially use this to look up which user it is associated with. Very convenient for single-press login, but it requires a decent bunch of per-website storage on the hardware token. Which is of course a net positive for the big tech companies, because it forced you into using smartphones as the token, and doing silly things like cloud sync with them.

The original FIDO U2F credentials were not resident. You'd enter your username, and the website would sent over a bunch of opaque blobs representing the associated hardware tokens. The hardware token would decrypt their blob using a key derived from a combination of the website's domain name and the hardware token's single stored secret, and then do the whole auth shenanigans using the data retrieved from the blob. Yubico invented a very nice protocol[0] around this "server-stored blob" idea to allow registering a backup security token, but the strong push towards insecure smartphone-stored cloud-synced Passkeys of course killed this.

[0]: https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...