Passkey auth

[gedw99]

I have been using passkeys auth for web and been wanting to use it for Native, and so Cognet might be the one.

Passkeys is easily the most secure Auth system and all Browsers and Mobile and Desktops now support it. If the server is hacked there is nothing to get. If the User is hacked there is nothing because the private keys are inside the TPM chip.

There is an issue here: egregors/passkey#11 to add Native, which you can follow.. It works with Web currently only. The repo is clean and tidy.

So I am interested in adding Passkeys to Cogent.

The Mail example in Cognet currently uses Google Signin, and needs a Project of gcloud. With Passkeys we will not need a Project running on gcloud as far as I know. Just highlighting one of the advantages. The trust is on the Users own Device and the TMP chip.

[kkoreilly]

If that issue is implemented upstream, then we could consider making a library that provides a login GUI for it. The issue for Cogent Mail is that we need access to emails stored in the gmail server (we are planning to add support for other mail servers like Microsoft Exchange soon). However, we could consider using this for other apps that don't have that constraint.

[gedw99]

thanks again @kkoreilly

Ok makes sense.

Just so you know, it's not definite yet if https://github.com/egregors/passkey will implement native passkey support.

Good to know how there mail thing is envisaged.