alt Hacker NewsYou don’t. You don’t store anything at all.
On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or hardware. The encrypted blob is sent to the server and stored there.
On authentication, after you enter your login, the server sends the encrypted blob and your security key tries to decrypt it with the long-term key it has. If it succeeds, it then request a challenge from the servers, signs it along with the server name and timestamp and sends back to the server. Server validates the signature and if it’s good, log you in.
Expanded: As long you as the user has the security key fob, you can login. You should have 2.
> You don’t. You don’t store anything at all.
Yes, you do.
Whenever a website offers to create a passkey, it could end up in any of these:
- Samsung's Password Manager (if using a Samsung phone)
- Apple's Keychain (if using an iPhone)
- Google Password Manager
- Your operating system's keychain
- A bespoke password manager (e.g., Bitwarden or LastPass)
- Your hardware key
Most users do not have a security key fob. Instead, the proposal being mostly pushed is the idea that users can store keys on their own smartphones, making use of the modern TPM and chip security. Most of the discussion here revolves around that idea: "What if I lose my phone? What if I switch phones?" and that's why the problems seem so obvious to you.
I absolutely agree the best solution is to use hardware keys, but I'll admit it's cumbersome if I need them for hundreds of accounts (which I do have), having to register both for every website and praying that I never lose both at the same time in the case there's no viable recovery flow for some of the accounts. Also, most of these hardware keys are limited to 25 or 100 resident keys, which again makes them unable to substitute passwords. Observe the usage of the term resident keys: passkeys do rely on the private key being stored on the hardware key, as that allows discovery.