7 ms·

Ahhh, container queries... here at last. Passkeys look very interesting as well. What kind of adoption do people expect passkeys to get? I had read that it w

Ahhh, container queries... here at last. Passkeys look very interesting as well. What kind of adoption do people expect passkeys to get? I had read that it was a general standard rather than Apple specific. I've gotten used to password managers but they've always felt like a man in the middle.

ArchOversight 4y ago
Passkeys are just WebAuthN.
- ptman 4y ago
  But very recent WebAuthN with (almost) all the extras. The featureset needed for passkeys doesn't seem to be very well supported on anything but Apple systems
als0 4y ago
FIDO is the general standard, though I'm unsure how Apple's implementation differs. The tricky aspect of Passkeys is that there doesn't seem to be an easy way to use them on non-Apple devices (IMHO not a deliberate lock-in, but a hard problem in general). I expect adoption to be slow because of this, in addition to the general problem of sites needing to adopt new authentication flows.
- CharlesW 4y ago
  > The tricky aspect of Passkeys is that there doesn't seem to be an easy way to use them on non-Apple devices (IMHO not a deliberate lock-in, but a hard problem in general). Not sure if this is what you mean, but Google has pledged rich passkeys support: https://blog.google/technology/safety-security/one-step-closer-to-a-passwordless-future/ https://blog.google/technology/safety-security/one-step-clos... Also, I'm under the impression that password managers will evolve to also become passkey managers. Am I missing some reason that can't happen?
  - als0 4y ago
    I think you're right that password managers will probably evolve to handle syncing across devices. I was thinking about how iCloud Keychain doesn't work with non-Apple devices (solvable with third party password managers, I assume).
    - CharlesW 4y ago
      Ah! Yes. But also surprisingly, maybe? https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en https://chrome.google.com/webstore/detail/icloud-passwords/p...
      - als0 4y ago
        Oh wow, I haven't seen this before. I guess Apple don't really advertise this. Thanks for sharing.
- alwillis 4y ago
  1Password announced support for Passkeys back in June, as did Google and Microsoft [1]. [1]: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
  - als0 4y ago
    But doesn't every website need to support passkeys? I'm not talking about client support. Server side support will have slow adoption.
    - MBCook 4y ago
      Yes, sites have to add their part too. It’s not something browsers add that “just works” everywhere like when auto-fill was created.
    - alwillis 4y ago
      I think most mainstream sites will upgrade fairly quickly. It’s great for them—no more password reset emails, etc.
CharlesW 4y ago
> Ahhh, container queries... here at last. For other folks wondering why this is seemingly very important: https://ethanmarcotte.com/wrote/on-container-queries/ https://ethanmarcotte.com/wrote/on-container-queries/
- aidos 4y ago
  Thanks. That makes a lot of sense. Can definitely see the utility in that.
olliej 4y ago
If you're using Safari there's password management builtin, though obviously that assumes you're Apple+iCloud+safari ecosystem only which is an infeasible restriction for many people. The passkeys API is afaict actually a spec to handle hardware token based login which Safari uses the builtin SEP (or the SE? I can honestly never recall which is which) so it's more streamlined than digging around for a token. But then I don't know how it (either the specification or the safari implementation) handles multiple devices. But again it seems possible that you hit similar "are you a safari only user?" ecosystem issues.
- MBCook 4y ago
  I think Apple released an extension (or something) to let you use your iCloud passwords in Chrome on Windows but I may be mistaken.
- alwillis 4y ago
  If you're using Safari there's password management builtin, though obviously that assumes you're Apple+iCloud+safari ecosystem only Safari actually uses Keychain, which has been part of macOS since it existed and long before Safari and iCloud were even thought of. But again it seems possible that you hit similar "are you a safari only user?" ecosystem issues. Passkeys is WebAuthn, an industry standard that uses public key encryption. Your public key is your identity and the private key is essentially your password. It doesn’t require a secure element or anything like that. There’s no reason why Passkeys created on a Mac can’t work on Windows or Linux that have browsers and password managers that support Passkeys/WebAuthn.
  - olliej 4y ago
    > Safari actually uses Keychain, which has been part of macOS since it existed and long before Safari and iCloud were even thought of. I know how safari and keychain works, and my statement stands as a reasonable summary of the end user experience. Keychain is the mechanism by which passwords are stored, but the integration into the browser is only available in Safari - you can manually open and use KeychainAccess to get the passwords for use in other browsers but that is far from what is expected from modern password manager UI - the UI for this path is even worse on iOS. To get the syncing between devices that people want from password managers using the safari password system requires an iCloud account. > Passkeys is WebAuthn, an industry standard that uses public key encryption The generation using the secure element/touchid seems to be safari only, and the key material is as you say stored in keychain, which other browsers do not use and so do not have access to. So using them has the effect of tying you to the safari/apple ecosystem. Question of ecosystems are a matter of "how does an end user actually use a feature?" not "could a sufficiently skilled user use the feature across multiple ecosystems?".

ArchOversight 4y ago

Passkeys are just WebAuthN.

ptman 4y ago
But very recent WebAuthN with (almost) all the extras. The featureset needed for passkeys doesn't seem to be very well supported on anything but Apple systems

als0 4y ago

FIDO is the general standard, though I'm unsure how Apple's implementation differs. The tricky aspect of Passkeys is that there doesn't seem to be an easy way to use them on non-Apple devices (IMHO not a deliberate lock-in, but a hard problem in general). I expect adoption to be slow because of this, in addition to the general problem of sites needing to adopt new authentication flows.

CharlesW 4y ago
> The tricky aspect of Passkeys is that there doesn't seem to be an easy way to use them on non-Apple devices (IMHO not a deliberate lock-in, but a hard problem in general). Not sure if this is what you mean, but Google has pledged rich passkeys support: https://blog.google/technology/safety-security/one-step-closer-to-a-passwordless-future/ https://blog.google/technology/safety-security/one-step-clos... Also, I'm under the impression that password managers will evolve to also become passkey managers. Am I missing some reason that can't happen?
- als0 4y ago
  I think you're right that password managers will probably evolve to handle syncing across devices. I was thinking about how iCloud Keychain doesn't work with non-Apple devices (solvable with third party password managers, I assume).
  - CharlesW 4y ago
    Ah! Yes. But also surprisingly, maybe? https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj?hl=en https://chrome.google.com/webstore/detail/icloud-passwords/p...
    - als0 4y ago
      Oh wow, I haven't seen this before. I guess Apple don't really advertise this. Thanks for sharing.
alwillis 4y ago
1Password announced support for Passkeys back in June, as did Google and Microsoft [1]. [1]: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
- als0 4y ago
  But doesn't every website need to support passkeys? I'm not talking about client support. Server side support will have slow adoption.
  - MBCook 4y ago
    Yes, sites have to add their part too. It’s not something browsers add that “just works” everywhere like when auto-fill was created.
  - alwillis 4y ago
    I think most mainstream sites will upgrade fairly quickly. It’s great for them—no more password reset emails, etc.

CharlesW 4y ago

> Ahhh, container queries... here at last. For other folks wondering why this is seemingly very important: https://ethanmarcotte.com/wrote/on-container-queries/ https://ethanmarcotte.com/wrote/on-container-queries/

aidos 4y ago
Thanks. That makes a lot of sense. Can definitely see the utility in that.

olliej 4y ago

If you're using Safari there's password management builtin, though obviously that assumes you're Apple+iCloud+safari ecosystem only which is an infeasible restriction for many people. The passkeys API is afaict actually a spec to handle hardware token based login which Safari uses the builtin SEP (or the SE? I can honestly never recall which is which) so it's more streamlined than digging around for a token. But then I don't know how it (either the specification or the safari implementation) handles multiple devices. But again it seems possible that you hit similar "are you a safari only user?" ecosystem issues.

MBCook 4y ago
I think Apple released an extension (or something) to let you use your iCloud passwords in Chrome on Windows but I may be mistaken.
alwillis 4y ago
If you're using Safari there's password management builtin, though obviously that assumes you're Apple+iCloud+safari ecosystem only Safari actually uses Keychain, which has been part of macOS since it existed and long before Safari and iCloud were even thought of. But again it seems possible that you hit similar "are you a safari only user?" ecosystem issues. Passkeys is WebAuthn, an industry standard that uses public key encryption. Your public key is your identity and the private key is essentially your password. It doesn’t require a secure element or anything like that. There’s no reason why Passkeys created on a Mac can’t work on Windows or Linux that have browsers and password managers that support Passkeys/WebAuthn.
- olliej 4y ago
  > Safari actually uses Keychain, which has been part of macOS since it existed and long before Safari and iCloud were even thought of. I know how safari and keychain works, and my statement stands as a reasonable summary of the end user experience. Keychain is the mechanism by which passwords are stored, but the integration into the browser is only available in Safari - you can manually open and use KeychainAccess to get the passwords for use in other browsers but that is far from what is expected from modern password manager UI - the UI for this path is even worse on iOS. To get the syncing between devices that people want from password managers using the safari password system requires an iCloud account. > Passkeys is WebAuthn, an industry standard that uses public key encryption The generation using the secure element/touchid seems to be safari only, and the key material is as you say stored in keychain, which other browsers do not use and so do not have access to. So using them has the effect of tying you to the safari/apple ecosystem. Question of ecosystems are a matter of "how does an end user actually use a feature?" not "could a sufficiently skilled user use the feature across multiple ecosystems?".