Technology

59135 readers

2878 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

141

GitHub launches passkey support into general availability (techcrunch.com)

submitted 1 year ago by Raisin8659@monyet.cc to c/technology@lemmy.world

25 comments fedilink hide all child comments

Summary

GitHub has officially launched its passkeys security feature into general availability, following a two-month beta testing period. Passkeys enable cloud-synced authentication using cryptographic key pairs, allowing users to sign in to websites and apps with their screen-lock PIN, biometrics, or a physical security key. This technology combines the security benefits of passwords and two-factor authentication (2FA) into a single step, simplifying secure access to online services. GitHub's move aligns with industry efforts, including collaborations between major tech companies like Google, Apple, Microsoft, and the FIDO Alliance, to make passwordless logins a reality across devices, browsers, and operating systems. Passkeys are seen as a significant step in enhancing security in the software supply chain, a vital aspect of the cybersecurity landscape.

you are viewing a single comment's thread
view the rest of the comments

[–] Asudox@lemmy.world 16 points 1 year ago (2 children)

Cool and all but I won't use them if I can't store them offline locally on my device. I am not going to use Google's passkey storage system.

[–] Raisin8659@monyet.cc 4 points 1 year ago (1 children)

There are two types of passkey. Syncable and device-bound. (see https://fidoalliance.org/passkeys/). Theoretically, the device-bound passkeys never leave the device and users don't have any access to it except to use it for authentication. The syncable type will first and foremost be synced by the platforms themselves (Google, Microsoft, and Apple), but eventually the 3rd-party password managers will be allowed to be sync providers, but possibly only on newly-released OSes.

As far as I know, the passkey implementations currently on Android and Windows are device-bound; they are not synced to the cloud.

[–] Asudox@lemmy.world 1 points 1 year ago

Windows currently doesn't sync, but GMS Android does.

[–] TurboLag@lemmings.world 1 points 1 year ago (1 children)

I haven't used passkeys yet, but I would hope that you can have multiple keys per site, not just one. So, after going through some initial pain of setting up each individual device, it should be nice having local-only keys for each of them, which you could revoke at any time.

Password managers are also adding support for passkeys, so you should be able to sync them if you so wish.

[–] Asudox@lemmy.world 1 points 1 year ago

I would use a U2F physical key to secure the password manager as securing the passkeys with a password sounds dumb. Passkeys are here to replace passwords as a more secure alternative. What's the logic behind securing them behind the thing it is supposed to replace?