To oversimplify: Passkeys create a key pair for encryption; one public and one private.
You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.
In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services. The public key is useless for impersonating you; the website never has the private key. A password is probably used on every single website a person visits. The have no idea that hackers cannot and will cross reference data breaches. They think “what are they gonna do with MY account? I don’t have anything on there!” Their perspective is limited.
Just don’t get your master password phished.
I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.
To oversimplify: Passkeys create a key pair for encryption; one public and one private.
You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.
In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services. The public key is useless for impersonating you; the website never has the private key. A password is probably used on every single website a person visits. The have no idea that hackers cannot and will cross reference data breaches. They think “what are they gonna do with MY account? I don’t have anything on there!” Their perspective is limited.
Just don’t get your master password phished.
I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.