Passkey is some sort of specific unique key to a device allowing to use a pin on a device instead of the password. But which won’t work on another device.
Now I don’t know if that key can be stolen or not, or if it’s really more secure or not, as people have really unsecure pins.
I have a long list of questions about PassKeys and none of this articles explains them well enough.
- Does Android have it build in AOSP or Google Play Services?
- Would it be possible to actually see your private key on Android? Like export them to a file?
- Does they work without third party service? Can it be just me and the service I am logging in, or does it require my servers from PassKey provider (like Google, Bitwarden, 1Password) to work?
- Can it be used offline? For example, can an offline device create token that second online device could use for login? (Like TOTP codes).
- Does they work on other Internet services than the Web? In other words, does they work purely over HTTP and webviews or can they be in future used to login in for ex. SSH servers?
Nothing of that?
You don’t need to export or know what is the key.
The key is different for each device.
You don’t need to export or know what is the key.
But is it possible in the implementation of Android/iOS?
Backups are a thing. With SSH keys I have different key for every device too, but as they are stored in an accessable file (as all computer data should be) they are backed up with the rest of the system.