I’m not necessarily a security expert, but my understanding is that passkeys are better in two (or more?) fundamental ways.
- it is linked to a domain, as the article states, which makes it less likely to “exposed” in phishing attempts
- it is a challenge system, essentially a public private key system, so the private key never leaves your device. Kind of like tls/https. Which means that even if bearer/login token is lost, your “password”(private key) isn’t lost.
- also, an obvious bonus is that you get a really long “password” which is practically impossible to guess
- it is linked to a domain, as the article states, which makes it less likely to “exposed” in phishing attempts - it is a challenge system, essentially a public private key system, so the private key never leaves your device. Kind of like tls/https. Which means that even if bearer/login token is lost, your “password”(private key) isn’t lost. - also, an obvious bonus is that you get a really long “password” which is practically impossible to guess
Sorry if any of my terminology is wrong here.