Software passkeys can’t provide attestation and don’t. A service requiring it would reject every apple and google device too. Its a feature for hardware like yubikeys and smart cards used by governments to ensure it’s not a knockoff with backdoors.
No thats actually not an issue at all if your device is secure and uses full disk encryption.
Oh I see your computer is secure well then nothing to worry about 🤣
If i want to write down my private key on a piece of paper and type it in by hand then thats my issue to deal with and not theirs.
With a hardware FIDO2 key, the private key never leaves the device, instead it signs challenges. Malware on the PC can’t access the private key and make it’s own copy.
Using software keys, they are at least encrypted in the vault until you open it, then there’ll be a window of time with a plain copy in memory that malware can potentially grab.
Your plaintext private key file can be stolen by malware easily and immediately. You would actually be better off with it written on a post it note.
Course in real life malware is gonna be stealing your browser cookies to gain access to your accounts and avoid the whole keypass thing. In the world that FIDO was born, authentication is happening all the time and any possibility of key theft is considered a compromise.
Software passkeys can’t provide attestation and don’t. A service requiring it would reject every apple and google device too. Its a feature for hardware like yubikeys and smart cards used by governments to ensure it’s not a knockoff with backdoors.
Oh I see your computer is secure well then nothing to worry about 🤣
With a hardware FIDO2 key, the private key never leaves the device, instead it signs challenges. Malware on the PC can’t access the private key and make it’s own copy.
Using software keys, they are at least encrypted in the vault until you open it, then there’ll be a window of time with a plain copy in memory that malware can potentially grab.
Your plaintext private key file can be stolen by malware easily and immediately. You would actually be better off with it written on a post it note.
Course in real life malware is gonna be stealing your browser cookies to gain access to your accounts and avoid the whole keypass thing. In the world that FIDO was born, authentication is happening all the time and any possibility of key theft is considered a compromise.