it only send the first 5 characters of the sha1 hash, thats pretty much useless for finding the password

thats what I meant. I was referring to setting PasswordAuthentication to no in the sshd_config.

just use ssh with password auth disabled, you can copy files over it with any sftp client or forward applications or an entire desktop session with waypipe. Way easier to set up and you’re not giving some silicon valley company full access to your home network nor are you affected by their services outages.

The web api for fido2/passkeys exposes attestation information.

Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.

from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API