Comments by "" (@himanshuchhabra1942) on "Ask Leo!"
channel.
-
9
-
6
-
4
-
3
-
3
-
3
-
3
-
3
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
2
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
@neuideas <Beyond that, you could always fall back on standard login credentials, assuming that's an option.>
If I can fall back on standard login credentials , then even hacker can also use those creditials to login in via phishing attack. Then whats the point of having passkeys
<You need to set up a backup device first, before you lose your primary device>
So u do agree that an account need to be logged in on atleast 2 devices before I lose one, so that the remaining device can be used to authenticate on the new device.
<You will need to authenticate the application first. This can be done by validating your account on an already authenticated device>
Ultimately , a second device with already logged in account is needed to validate on a new device
<It's different because it uses public key verification of digital signing, rather than hashing a password. The burden shifts from remembering your login information, to not losing your private keys. The private keys are never revealed, so they are never risked.>
I understood the mechanism , I was trying to understand the big picture. My point was private keys revelation is not needed, if the hacker can use other ways of authentication which are provided for the user in case he loses the device.
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1
-
1