who creates the passkey (and how many will be created)?

r j

7/11/24, 11:31 AM

Passkey is nice. The math is nice. The tech is nice. https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html

What I still dont see after sooo many hours: what software creates the passkey. User autonomy is important and it is a (private) key question (pun intended). I do not really see this answered anywhere.

Of course it is created on the device. But is it the pass manager or the operating system? It should be the pass manager, since we store our secrets in a pass manager that we trust.

I am not hostile to Apple, Google, Microsoft (or Linux), I use the Google Pass Manager btw. But it should be a choice and if you choose an open source pass manager (which I might in the future), it should create the key pair (and with it, the secret private key).

However, it seems to me that pass managers may only get API from the os and the os creates the keys as of now. Practically as of now, 3 US companies would create all the secrets of the world in the future? https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys

Another thing I cant get my head around: A passkey requires a pass manager. Should domain service providers (relying party) let users that do not use cross platform pass managers create passkeys on Apple, Google, Microsoft (later on Linux) and so having secrets in 4 pass managers eventually.

Or just let them create the one and only passkey (until deletion or change) and it is the responsibility of the user (and actually AGML) that they can sync THE passkey cross platform? And how will this happen? Export, encrypted export, magic?

Since this is crypto exchange: does it matter whether OS or pass manager creates the secret key? Does the OS not see everything anyways? (and store and send to anywhere)

1 + 2

passwords

key-exchange

data-privacy

key-generation

fgrieu

7/11/24, 11:49 AM

Even if a pass manager had the ability to accept a private key of one's choice, I don't see that it should rationally make one much less worried that the key is abused thru a weakness (intentional or not) of the pass manager or platform. The hard part is not generating the key; it's keeping it safe from disclosure and abusive use; and convincing users of that.

r j

7/11/24, 3:28 PM

well with the apple/google implementation based on webauthn the passkey is the private key and if I am not mistaken (I am 100% sure), it is happily synced via apple/google pass manager: https://support.apple.com/en-us/HT213305, https://developers.google.com/identity/passkeys/supported-environments, and pass managers working on total cross platform sync: https://www.future.1password.com/passkeys/, I find it funny that after so much time I found no discussion of a very basic question: who creates the key pair in the first place?

Score:0

Crypto

r j

8/14/24, 1:49 PM

In retrospect my question is not a good fit for crypto stackexchange so I close this.

It is rather a specs and implementation discussion, nothing really crypto is there. I already closed the same question on stackoverflow where I accepted an answer: https://stackoverflow.com/questions/76660638/who-creates-the-passkey-and-how-many-will-be-created

+ 2

DannyNiu

8/15/24, 1:20 AM

I have voted to close the Q as needing focus considering your opinion. If you changed your mind, ping me with an '@' sign.

r j

8/15/24, 12:06 PM

you can delete this Q if you can/want... it may be good on security stackexchange but I already accepted an answer on stackoverflow... in the future, I will take my time to figure out where to publish (stack, security, crypto) and only publish on one site... thanks!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: who creates the passkey (and how many will be created)?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.