3 ms·

This has existed for years. I use 1Password for all my passwords and it shows up as an option when entering or creating a password in any browser on iOS. Furthe

This has existed for years. I use 1Password for all my passwords and it shows up as an option when entering or creating a password in any browser on iOS. Furthermore, all browser can access the keychain if the user authorizes it.

oarsinsync 4y ago
1Password doesn't perform WebAuthn logins, only password (and TOTP) based logins. The GP is talking about WebAuthn / FIDO2 logins.
- howinteresting 4y ago
  1password is going to implement WebAuthn in the future: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all... However, the lock-in concern remains: how can you export passkeys to another password manager the same way you can export passwords to it?
  - 0x457 4y ago
    Well, the point of such keys is that you can't extract the private part. I've never met a single service that supports Webauthn and doesn't allow you to have multiple tokens: every time I enroll into a new service, I do this: add physical key, add desktop (Windows Hello) if it's personal, add laptop (Touch ID) of it's work and maybe Face ID on iPad.
    - howinteresting 4y ago
      I have close to a thousand unique websites and passwords in my password manager. It is completely unreasonable for me to expect to re-enroll a thousand times.
      - 0x457 4y ago
        Then WebAuthn and PassKey isn't for you. I absolutely do not want secret key to be exportable in this context.
g_p 4y ago
Passkeys are a little different - at heart, you can export or write down (on paper, if it comes to it) your passwords, and then import them into another password manager if you choose to. If you want to move from the built-in keychain to 1Password, you can do an export/import operation, and have your passwords in 1Password. You inherently can't copy-paste a passkey, since it's an asymmetric public/private keypair authentication. These keys are (usually) decrypted by a single symmetric key that you protect well. If you allow that key to be exported, you're back to "one password for every website"! When this is done on a hardware-protected security engine (which doesn't permit any extraction of the key), it's arguably quite secure, but you don't then have any migration path.
- pabs3 4y ago
  Apple are allowing those private keys to be synced to iCloud and I thought also synced to other devices a person owns.
pasc1878 4y ago
The operative word here is can. Does Firefox use the keychain - on macOS it does not even try

oarsinsync 4y ago

1Password doesn't perform WebAuthn logins, only password (and TOTP) based logins. The GP is talking about WebAuthn / FIDO2 logins.

howinteresting 4y ago
1password is going to implement WebAuthn in the future: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all... However, the lock-in concern remains: how can you export passkeys to another password manager the same way you can export passwords to it?
- 0x457 4y ago
  Well, the point of such keys is that you can't extract the private part. I've never met a single service that supports Webauthn and doesn't allow you to have multiple tokens: every time I enroll into a new service, I do this: add physical key, add desktop (Windows Hello) if it's personal, add laptop (Touch ID) of it's work and maybe Face ID on iPad.
  - howinteresting 4y ago
    I have close to a thousand unique websites and passwords in my password manager. It is completely unreasonable for me to expect to re-enroll a thousand times.
    - 0x457 4y ago
      Then WebAuthn and PassKey isn't for you. I absolutely do not want secret key to be exportable in this context.

g_p 4y ago

Passkeys are a little different - at heart, you can export or write down (on paper, if it comes to it) your passwords, and then import them into another password manager if you choose to. If you want to move from the built-in keychain to 1Password, you can do an export/import operation, and have your passwords in 1Password. You inherently can't copy-paste a passkey, since it's an asymmetric public/private keypair authentication. These keys are (usually) decrypted by a single symmetric key that you protect well. If you allow that key to be exported, you're back to "one password for every website"! When this is done on a hardware-protected security engine (which doesn't permit any extraction of the key), it's arguably quite secure, but you don't then have any migration path.

pabs3 4y ago
Apple are allowing those private keys to be synced to iCloud and I thought also synced to other devices a person owns.

pasc1878 4y ago

The operative word here is can. Does Firefox use the keychain - on macOS it does not even try