Get the latest tech news
The cryptography behind passkeys
This post will examine the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.
When you visit a website, the server typically proves its identity through a Transport Layer Security (TLS) certificate authenticated by the Web Public Key Infrastructure (PKI). Examples: iCloud Keychain, Google Password Manager, Windows Hello, 1Password Pros: Convenient, often include cloud backup capabilities Cons: Vulnerable if the device itself is compromised Implementing subresource integrity for code on the web (e.g., storing the hash of all published versions with a trusted third party) and binary transparency techniques (e.g., a publicly verifiable, tamper-evident log) are two promising solutions to this kind of problem.
Or read this on Hacker News
