Passkeys anyone?

[Goverp]

A recent edition of a (Windows) PC mag extolled the virtues of passkeys - IIUC using public key cryptography for secure logon, and using 2 factor authentication (such as a fingerprint reader-secured smartphone) to access those keys. The intent is removing passwords completely, and login could be by, for example, a bluetooth exchange with said smartphone; there are alternatives including Yubikeys, scanning QR codes with a smartphone, etc.

A search on the Gentoo fora and wiki reveals nothing (except a few old posts using "passkey" to mean password). Googling "linux passkey" isn't too helpful neither.

Anyone know if it's just hype, "coming soon", already here, or not as good as something else?
_________________
Greybeard

[pjp]

What do you mean by hype?

I believe github started to require 2FA a while ago after a breach. Apparently it was scheduled for this year.

https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa

I think gmail started to recently require 2FA, though I can't find the reference. What I'm seeing (search results) is only certain features, and a passkey isn't required.


My concern is having to deal with the lack of security in requiring a phone (SMS). I no longer use my phone for much of anything other than the phone. I also don't use app stores. I'm really supposed to tie up important accounts with an easy to lose usb key? That sounds like a brilliant idea. Better yet, it has an ESD event. Also, I'm not giving private information to the organizations that want it just so they can have it for "security."
_________________
Quis separabit? Quo animo?

[Goverp]

"Hype" would be as in a new name for old technology that's not particularly used.

As I read it, this is supposed to be more than just 2FA, specifically getting rid of passwords, which I'd quite like.

I agree about the danger of losing a device if it's the sole repository for the key. However, if that key is a public/private keypair sitting, for example, on a fingerprint-protected phone, I can and would have a backup of those keys, so losing the phone is not the end of the world. Anyway, I expect that as long as I knew my mother's maiden name and a couple other bits of public data, I could get Google or Apple or someone to reinstate my passwords
_________________
Greybeard

[spica]

The adoption of passwordless devices introduces a potential vulnerability,
allowing third parties to gain unauthorized access or decrypt disks in the
absence of the device owner. While the password may still exist, residing
either on the target system or within the device as a key, the decision
to disable user passwords seems like an effort to shift responsibility from
the system to the end user, in my opinion.

[hdcg]