@solonovamax it's actually pretty amazing tech, in its most basic form it prevents phishing pages from being able to steal your credentials. Unfortunately the specs have a lot options so real world implementations are shit half the time.
@lunareclipse@solonovamax I do wonder how the phishing resistance would work for anything that has multiple legitimate clients. Anything like IRC, xmpp, matrix, or even third party clients to closed silos. OAUTH isn't phishing resistant if the client logs in with that, but may be able to scope the impact. It's entirely possible I'm missing something fundamental.
Really the main benefit IMO is that it makes bad passwords not possible/effectively forces using a password manager, but then unfortunately it's hard to say the rollout is anything but a disaster.
@walnut@solonovamax on mobile, for an app to log in with a passkey it has to either be registered as a browser app or have a hard-coded list of RP IDs
So your best bet for logging in via passkeys to an arbitrary service is opening a custom browser tab with an oauth2 authorization page which will get back to your app with a token
@lunareclipse@solonovamax Thanks, so I don't think I was missing anything. I still feel fine not using them personally then. A password manager browser extension can do domain based matching which makes phishing more difficult on the web while also making login easier. So the main benefit is that passkeys always do this, and oauth sessions may be more easily revoked or expired.
Passkey shaped things also means that server side they can't be storing passwords in plaintext or hashed with md5 without a salt or anything, so there's that too.
@lunareclipse@snug.moe
