5 ms·

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong

by mhoad 4y ago

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

Ajedi32 4y ago
Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform. I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implement it, but it's going to be kind of rough in the short term until then.
- ChadNauseam 4y ago
  That would be nice. I used Hanko for one service I built that uses WebAuthn+email, so new devices get a one-time code in their email and existing just use WebAuthn. It would be kind of nice not to have to rely on email, but it's better than making people remember passwords.
- mhoad 4y ago
  Except Apple are kind of notorious about avoiding cross platform compatibility which is why I ask. Find them hard to trust at this point. I can already hear them making the “we can’t because it will impact users security” argument in my head.
  - stetrain 4y ago
    For normal passwords they currently seem to support third party password managers just fine, including direct integration in Safari and the iOS keyboard. You can also export everything from iCloud Keychain to use with another password manager. They could always use Passkeys as an opportunity to lock things down but it would be in direct contrast to what they have been doing with password management recently.
    - fauigerzigerk 4y ago
      >You can also export everything from iCloud Keychain to use with another password manager. I can't export anything. This menu item is always disabled for some reason.
    - deleted 4y ago
      [deleted]
floatboth 4y ago
Just add more authenticators to every RP (site you auth into). From the point of view of an RP, "your account in the Apple ecosystem" here is the exact same thing as "one of your Yubikeys", basically.
- jml7c5 4y ago
  That seems like an enormous pain if you have dozens or hundreds of services. It could take hours to do this one at a time. (I'm assuming one minute per service, though that depends on how hard it is to find the "add another authenticator" page for each service.) It's possible I'm unaware that there is a simple protocol for this. Am I incorrect here?
  - floatboth 4y ago
    Well, realistically not all services will support WebAuthn… spending an hour to handle a dozen important ones doesn't sound like a big deal to me.
    - jml7c5 4y ago
      The goal of the recent initiatives is to create widespread passwordless authentication, so it seems likely that the number of services that support WebAuthn will grow dramatically over the next few years.
  - drexlspivey 4y ago
    You should always add at least two keys for every service in case you lose the first anyway. That was the case even before Apple passkey so just keep doing the same.
    - jml7c5 4y ago
      This isn't a great solution, as in order to enrol in new services you have to either retrieve your backup key from its safe storage location, or keep the backup key with you at all times (which defeats its purpose). And if you do move away from Apple's Passkey to your second key, you'll want to buy and set up a new backup key. So have to do the tedious mass-enrollment anyway.
deleted 4y ago
[deleted]
gwbas1c 4y ago
As long as your account is tied to your email address, there should be something similar to a password reset.
- deleted 4y ago
  [deleted]
stjohnswarts 4y ago
I always was curious about this stuff. I don't want all my eggs in a basket and have to depend completely on others for "logging in". Apple and Google and other Big Corps(tm) have shown they are just fine with terminating your accounts without any recourse and/or warning with no practical way to appeal it. Passwords managers aren't subject to that limitation and all faang companies can do is kill your accounts for their particular services.

by mhoad 4y ago

Ajedi32 4y ago

Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform. I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implement it, but it's going to be kind of rough in the short term until then.

ChadNauseam 4y ago
That would be nice. I used Hanko for one service I built that uses WebAuthn+email, so new devices get a one-time code in their email and existing just use WebAuthn. It would be kind of nice not to have to rely on email, but it's better than making people remember passwords.
mhoad 4y ago
Except Apple are kind of notorious about avoiding cross platform compatibility which is why I ask. Find them hard to trust at this point. I can already hear them making the “we can’t because it will impact users security” argument in my head.
- stetrain 4y ago
  For normal passwords they currently seem to support third party password managers just fine, including direct integration in Safari and the iOS keyboard. You can also export everything from iCloud Keychain to use with another password manager. They could always use Passkeys as an opportunity to lock things down but it would be in direct contrast to what they have been doing with password management recently.
  - fauigerzigerk 4y ago
    >You can also export everything from iCloud Keychain to use with another password manager. I can't export anything. This menu item is always disabled for some reason.
  - deleted 4y ago
    [deleted]

floatboth 4y ago

Just add more authenticators to every RP (site you auth into). From the point of view of an RP, "your account in the Apple ecosystem" here is the exact same thing as "one of your Yubikeys", basically.

jml7c5 4y ago
That seems like an enormous pain if you have dozens or hundreds of services. It could take hours to do this one at a time. (I'm assuming one minute per service, though that depends on how hard it is to find the "add another authenticator" page for each service.) It's possible I'm unaware that there is a simple protocol for this. Am I incorrect here?
- floatboth 4y ago
  Well, realistically not all services will support WebAuthn… spending an hour to handle a dozen important ones doesn't sound like a big deal to me.
  - jml7c5 4y ago
    The goal of the recent initiatives is to create widespread passwordless authentication, so it seems likely that the number of services that support WebAuthn will grow dramatically over the next few years.
- drexlspivey 4y ago
  You should always add at least two keys for every service in case you lose the first anyway. That was the case even before Apple passkey so just keep doing the same.
  - jml7c5 4y ago
    This isn't a great solution, as in order to enrol in new services you have to either retrieve your backup key from its safe storage location, or keep the backup key with you at all times (which defeats its purpose). And if you do move away from Apple's Passkey to your second key, you'll want to buy and set up a new backup key. So have to do the tedious mass-enrollment anyway.

deleted 4y ago

[deleted]

gwbas1c 4y ago

As long as your account is tied to your email address, there should be something similar to a password reset.

deleted 4y ago
[deleted]

stjohnswarts 4y ago

I always was curious about this stuff. I don't want all my eggs in a basket and have to depend completely on others for "logging in". Apple and Google and other Big Corps(tm) have shown they are just fine with terminating your accounts without any recourse and/or warning with no practical way to appeal it. Passwords managers aren't subject to that limitation and all faang companies can do is kill your accounts for their particular services.