upvote
Did you try it? That’s not correct. I just logged into GitHub with a password (+ 2FA), on an account that also has a passkey.

No major bank revokes your password when you setup a passkey, either.

reply
Is "passkey" only supposed to mean devices that implement specifically U2F, WebAuthn, etc.? I would have thought TOTP and challenge-response hardware tokens to count, including cellphones with apps that implement such.

As to

> No major bank revokes your password when you setup a passkey, either.

If we're talking about requiring 2FA via TOTP or challenge-response hardware tokens or banking apps implementing such, that depends on the country. It's the status-quo in some places. Some banks even put the input field for the token output as a third input in the login form on their website because all customers have them. The rest separate their login form in multiple steps, but they likely require it of all customers too.

reply
> I would have thought TOTP and challenge-response hardware tokens to count

Those are absolutely not passkeys. Passkeys are just WebAuthn (from what i can tell).

reply
Such a generic word. I imagine there are tons of CLI utilities out there with a --passkey option that refer to simply files with a key inside. Kind of crazy that it's being used to mean specifically devices that implement a specific protocol.

Kind of feels like "crypto is a type of currency and not all cryptography", or "SQL Server is a specific product of Microsoft".

Wonder if how it happened this time was people read the specs and explanations of WebAuthn, saw "passkey", never seen that word before and assumed it's only ever been used in the super narrow context of WebAuthn so it can only mean that. Maybe "header" can only ever mean "HTTP header".

Thinking about it like that, it may be more like how "latte" is specifically espresso with milk (it's really just milk), or "queso" is specifically cheese dip (it's really just cheese of any kind), or "masa" is specifically made of corn (it's really just dough of any kind, or it's mass like atomic mass is masa atómica).

reply
Isn't the standard term for what you're referring to a "keyfile"? Google Trends also indicates nobody was caring about "passkey" before 2022.
reply
There's no standard. "key" and "keyfile" are the most common, but they're not the only option. It can also be referred to as a "password file", since there's really not much difference between the concept of a password/passphrase and a key. A password is basically just a key you can remember, and hence tends to be shorter and legible. That's why e.g. from cryptsetup-open(8):

> --key-file Read the passphrase from the file.

They're synonyms to a degree.

Re: "passkey". You can search github:

> The password key file can then be used with the --passkey option. It provides the same security level as using the --passfile option but helps in setting up and using separate key files for different wallets.

> parser.add_argument('--passkey', help='YOUR_PASSWORD')

On

> Google Trends also indicates nobody was caring about "passkey" before 2022.

I think how this tends to happen is you have a term in a population and a larger population outside of it sees it in a very specific context and tightly ties the term to that very specific context. With the "masa" thing, when you're working with dough you don't tend to always specify "get me the wheat dough". You just leave the type implicit. Sufficient English-speakers must have heard "masa" in Mexico or something, where most dough tends to be made of corn and assumed that the term "masa" must only be usable in the context of "corn".

reply
"Passkey" refers to a very specific authentication method. TOTP, etc., don't count.
reply
Porkbun too
reply