Unit 7: Logins, MFA and tokens · Lesson 4 of 7 · 14 min
Passkeys
A key pair bound to the site's name, so a lookalike site gets nothing it can use.
mission
- You are
- The analyst advising the shop team.
- Situation
- Product wants to replace text message codes. You need to explain passkeys in one meeting.
- Goal
- Understand what a passkey stores, what the site stores and why phishing fails against it.
- Hand in
- A one-paragraph recommendation.
A passkey as a site-bound key
Registration
The device makes a new key pair for this one site. The site keeps only the public key.
Sign-in
The site sends a random challenge. The device signs it with the private key, but only after checking that the site's name matches the one the key was made for.
The lookalike
A phishing site on another domain asks for a signature. The device finds no key for that name and refuses. There is no code for the user to read out and nothing to type.
What a breach leaks
user,hash old_sales,md5$$5f4dcc3b...
Hashes can be guessed offline; reused passwords work elsewhere.
user,credential_id,public_key learner,AQID...,pQECAyYg...
Public keys are useless to an attacker.
What a defender takes away
- 1The private key never leaves the device and is never typed.
- 2Passkeys are bound to the site's name, which defeats lookalike sites.
- 3A stolen passkey database holds only public keys.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.