Comment

Comment by TulliusCicero

This goes into more detail: https://developers.google.com/identity/passkeys

As far as I can tell: it's a system of private keys stored on devices, in order to transmit a key you also need to unlock a device (e.g. phone) with some other method like a PIN or fingerprint/face scan. Combine those two things and it means a would-be hacker would need both the physical device as well as the local authentication for that device (PIN or biometrics).

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton