Clatheticclathetic@infosec.exchange
Oct 15, 2026, 8:50 AMPasskeys are client certificates with better marketing.
Replies
- Clatheticclathetic@infosec.exchangeOct 15, 2026, 8:50 AM
We already have public-key authentication, hardware-backed private keys, device-specific credentials, multiple keys per user, certificate issuance, expiration and revocation. None of this is new, and none of it is particularly complicated. Issue a client certificate, bind it to an identity, let the client prove possession of the private key. Store that key in a file, in a TPM, a secure enclave or a hardware token. Protect this key with a password, with biometric, with proof-of-presence, whatever. One certificate per device? Sure. Short-lived, long-lived, revocable? That's all standard PKI features, known for decades. And it's a standard protocol, supported across operating systems, browsers, servers and infrastructure.
- Clatheticclathetic@infosec.exchangeOct 15, 2026, 8:50 AM
Passkeys sells phishing resistance as a top-notch quality above everything else? Yeah yeah yeah, visit a site that requests your certificate, and you can be authenticated without ever typing a password. No password to steal, no OTP to relay, no credentials to replay. With the right client and certificate-selection setup, you can even get seamless authentication. Passkeys bring origin binding and a polished UX to the same fundamental idea. That's useful engineering, but let's not pretend phishing-resistant public-key authentication was invented yesterday.
- Clatheticclathetic@infosec.exchangeOct 15, 2026, 8:51 AM
The real question isn't whether passkeys are magic. It's why we spent decades treating client certificates as an enterprise-only nightmare instead of making them usable everywhere. We didn't need a new cryptographic primitive. We needed better product management. And apparently, a new name. So, yes, that's just marketing, polished UI, and endless questions for average tech user (where are my passkeys? how do I save them, store them, use them, erase them?).