alt Hacker NewsReplace the word passkey with password in your comment. What’s the benefit of passkeys again?
If you’re not storing the actual private key in the Secure Enclave but only the “access to it” what’s changed from how Apple’s keychain already manages password syncing to iCloud?
The only benefit (and it’s still a decent one) is that some random website breach can’t disclose your private key.
Replies
A random website breach can't disclose your password either, assuming you use random high-entropy passwords and the website only stores a hash of it. I haven't really seen the benefit to passkeys over passwords. Pretty much everyone is using a password management service that securely syncs both passwords and passkeys across devices. In that context I don't see the difference.
The far bigger benefit is phishing resistance (with hardware-contained keys themselves being phishing-proof on a non-compromised system).
It moves to the account recovery flows, but that can be much more difficult to phish.