And if the site is hacked, they can get a lot of information about how the passkeys
I don’t like passkeys, but this is not a real worry, unless the service you are using is ran by idiots. I mean to say that knowing how passkeys are generated is typically not helpful in guessing your passkey. There are more interesting questions where security fumbles, like is your data encrypted on the provider side & is that encryption tied to your passkey or not, often not, since they want to mine your data.
Have you ever used bank software, or some government services site? It is often really hard to not get the idea that it was designed and run by idiots. As someone who’s worked as a software developer most of my life, it is not difficult for me to believe it, either.
You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
But your private key should never leave your secure storage to be put anywhere. If you somehow export it and then also give someone or an LLM access to it, then this is ofc very stupid. But this attack vector is possible with every authentication.
I don’t like passkeys, but this is not a real worry, unless the service you are using is ran by idiots. I mean to say that knowing how passkeys are generated is typically not helpful in guessing your passkey. There are more interesting questions where security fumbles, like is your data encrypted on the provider side & is that encryption tied to your passkey or not, often not, since they want to mine your data.
Have you ever used bank software, or some government services site? It is often really hard to not get the idea that it was designed and run by idiots. As someone who’s worked as a software developer most of my life, it is not difficult for me to believe it, either.
You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
But your private key should never leave your secure storage to be put anywhere. If you somehow export it and then also give someone or an LLM access to it, then this is ofc very stupid. But this attack vector is possible with every authentication.