10PRINT"So in order to log into most websites, you need your username/email address and a password."20PRINT""30PRINT"You can save your username/password in your web browser or in the cloud."40PRINT""50PRINT"Sometimes people get lazy and reuse passwords, sometimes people forget their passwords."60PRINT""70PRINT"Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard)."80PRINT""90PRINT"When you "; CHR$(34); "create"; CHR$(34); " a passkey, this passkey is used only at a single place. For example, you"; CHR$(39); "d have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that"; CHR$(39); "s just how it works."100PRINT""110PRINT"When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that"; CHR$(39); "s it. There is no email address, there is no password, no MFA."120PRINT""130PRINT"edit: oh, you also asked about the difference between passwords."140PRINT""150PRINT"It"; CHR$(39); "s all about improved security."160PRINT""170PRINT"You go to certain websites, and they"; CHR$(39); "ll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)"180PRINT""190PRINT"Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?"200PRINT""210PRINT"If you look at the number of "; CHR$(34); "breached/leaked"; CHR$(34); " passwords on the internet, it"; CHR$(39); "s because it"; CHR$(39); "s hard to securely store passwords."220PRINT""230PRINT"Passkey solves all this. Websites are just given "; CHR$(34); "a public key"; CHR$(34); " and it can be "; CHR$(34); "just stored"; CHR$(34); ", no special treatment necessary."
Your 1234 example is stored in plaintext, which is bad practice but still happens sometimes. Usually 1234 will be hashed (irreversible and functionally unique string) and the user input gets hashed with the same algorithm to check against the server’s stored hash.
Passkeys are fundamentally different and work with public-private key pairs. It’s not possible for your public key to be “stored incorrectly” because it’s meant to be public. Your private key stays private and you never have to send it to the server to be checked against what they have stored. Instead, the server sends you a mathematical challenge that you solve with your private key. The resulting answer is also irreversible and functionally unique, but in such a way that the answer can be checked with the public key to make sure it was solved by the associated private key. It’s really clever math that’s worth watching or reading up on to understand.
I don’t understand the maths well enough to give you a pseudocode example, but I always found trying to simplify it made it difficult to understand anyway. Every analogy ended up falling short because it was an analogy and not what was actually happening under the hood.
10 PRINT "So in order to log into most websites, you need your username/email address and a password." 20 PRINT "" 30 PRINT "You can save your username/password in your web browser or in the cloud." 40 PRINT "" 50 PRINT "Sometimes people get lazy and reuse passwords, sometimes people forget their passwords." 60 PRINT "" 70 PRINT "Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard)." 80 PRINT "" 90 PRINT "When you "; CHR$(34); "create"; CHR$(34); " a passkey, this passkey is used only at a single place. For example, you"; CHR$(39); "d have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that"; CHR$(39); "s just how it works." 100 PRINT "" 110 PRINT "When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that"; CHR$(39); "s it. There is no email address, there is no password, no MFA." 120 PRINT "" 130 PRINT "edit: oh, you also asked about the difference between passwords." 140 PRINT "" 150 PRINT "It"; CHR$(39); "s all about improved security." 160 PRINT "" 170 PRINT "You go to certain websites, and they"; CHR$(39); "ll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)" 180 PRINT "" 190 PRINT "Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?" 200 PRINT "" 210 PRINT "If you look at the number of "; CHR$(34); "breached/leaked"; CHR$(34); " passwords on the internet, it"; CHR$(39); "s because it"; CHR$(39); "s hard to securely store passwords." 220 PRINT "" 230 PRINT "Passkey solves all this. Websites are just given "; CHR$(34); "a public key"; CHR$(34); " and it can be "; CHR$(34); "just stored"; CHR$(34); ", no special treatment necessary."I wish I could give more than one upvote for the commitment to the bit on this.
No, I mean the actual code. It’s been decades since I’ve used BASIC but a password programd would look vaguely like this:
10 x=1234
20 Print “What is the password?”
30 If user input equals 1234 goto 60
40 Print “Incorrect”
50 Goto 20
60 Print “Correct”
Your 1234 example is stored in plaintext, which is bad practice but still happens sometimes. Usually 1234 will be hashed (irreversible and functionally unique string) and the user input gets hashed with the same algorithm to check against the server’s stored hash.
Passkeys are fundamentally different and work with public-private key pairs. It’s not possible for your public key to be “stored incorrectly” because it’s meant to be public. Your private key stays private and you never have to send it to the server to be checked against what they have stored. Instead, the server sends you a mathematical challenge that you solve with your private key. The resulting answer is also irreversible and functionally unique, but in such a way that the answer can be checked with the public key to make sure it was solved by the associated private key. It’s really clever math that’s worth watching or reading up on to understand.
I don’t understand the maths well enough to give you a pseudocode example, but I always found trying to simplify it made it difficult to understand anyway. Every analogy ended up falling short because it was an analogy and not what was actually happening under the hood.