25
16 Billion Apple, Facebook, Google And Other Passwords Leaked — Act Now (www.forbes.com)
submitted 1 year ago by to c/technology@piefed.social
13 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 1 year ago (5 children)

change your account passwords, use a password manager and switch to passkeys wherever possible.

Can someone explain to me how passkeys are more secure / better than passwords?

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 7 points 1 year ago* (last edited 1 year ago) (3 children)

    Passkeys are a cryptographic public key authentication system, similar to how SSH keys work.

    Your password manager stores your passkeys. You must complete a private/public key pair challenge with the website you are trying to authenticate with in order to login using your passkey.

    It changes the factor from "something you know" to "something you have".

    Most password managers require biometrics (something you are), or require a master password (something you know). Once this is paired up with a passkey (something you have), it means you are using multi-factor authentication to login, which is much stronger than using just username and password.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 1 year ago (2 children)

    Wait does 2FA count as a passkey?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 year ago* (last edited 1 year ago) (1 child)

    No, two factor authentication does not mean it is a passkey.

    Email is something you know, but also something you have. You know the username and password to your inbox, but you have access to your inbox if you stay logged in, so this can be either factor. A phone number is something you have, so you can receive text messages with it as a factor. Passkeys are its own technology that fit into the something you have category. Once you have two of these factors combined, thats how you get the 2FA experience.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 year ago

    A super basic explanation as I understand it.

    With a passkey the server (like Google) only has half of the passkey, you have the other half.

    So having the server half be made public is still safe, as it's not useful on its own without the other half that you still have kept private.

  • permalink
  • fedilink
  • source
  • parent