Skip to main content

Please, please, please stop using passkeys for encrypting user data

Passkeys Reading

When you overload a credential used for authentication by also using it for encryption, the ‘blast radius’ for losing that credential becomes immeasurably larger.

Eli Grubb
Author
Eli Grubb
I am a privacy-oriented software engineer with a strong foundation in applied cryptography, reliable data systems, and secure system design.