Gregory's Server@sitnik_ru well public key can leak, no?
|
5 comments
 @dotfox @sitnik_ru sure, it’s just Andrey tried to say it is somehow an unique attribute of passkeys, which is wrong. Normally website DBs don’t store user passwords either, so these can’t leak either. They store emails, which in passkey case is the same as storing public part  @nikitonsky can. But with a public key you can't login. For login you sign random data from the server with a private key and send a signature to the server. So public key leakage has no security issues for you. @nikitonsky email is a user’s global ID, not a secret. The public key is unique for each website and can't be used to identificate users. A public key is better than a password hash because of the better crypto methods behind (it is hard to do hash right). |
@nikitonsky @sitnik_ru yes, but that is its purpose.