Passkeys use a challenge response protocol where the server sends a challenge to the browser for a specific public key and the browser signs the challenge with the corresponding private key. Keys aren't re-used across domain names which makes the credentials phishing-resistent
The user is required to enter a pin or password to unlock the private key (e.g. stored on their Yubikey or in their password manager) but that's a local decision. Also because a Yubikey and implement local rate limiting you don't need to have a long complicated password but a simple pin might suffice. Or you can use biometrics . This makes a passkey an authentication method with two factors. You provide something you know or are, and something you have.
OPAQUE instead is a key exchange protocol where you establish a secure session with only your password without ever disclosing that password to the server.
However, it's a single factor. You only provide your password as input.
The other problem with OPAQUE is that unlike passkeys there is no anti-phishing guarantee. A user might be tricked into entering their password into another website .
I guess this could be mitigated with browser support that derives a unique key from your password for each domain. But that browser support doesn't exist whilst passkeys do.
In my opinion passkeys are more pragmatic than OPAQUE as the security doesn't rely on the user having to pick a secure password and because there is browser support today
The user is required to enter a pin or password to unlock the private key (e.g. stored on their Yubikey or in their password manager) but that's a local decision. Also because a Yubikey and implement local rate limiting you don't need to have a long complicated password but a simple pin might suffice. Or you can use biometrics . This makes a passkey an authentication method with two factors. You provide something you know or are, and something you have.
OPAQUE instead is a key exchange protocol where you establish a secure session with only your password without ever disclosing that password to the server.
However, it's a single factor. You only provide your password as input.
The other problem with OPAQUE is that unlike passkeys there is no anti-phishing guarantee. A user might be tricked into entering their password into another website .
I guess this could be mitigated with browser support that derives a unique key from your password for each domain. But that browser support doesn't exist whilst passkeys do.
In my opinion passkeys are more pragmatic than OPAQUE as the security doesn't rely on the user having to pick a secure password and because there is browser support today