4 ms·

With what looks like broad industry adoption of passkeys, are password management products doomed? Will passwords go away forever? Looking at my 1Password datab

by tedd4u 4y ago

With what looks like broad industry adoption of passkeys, are password management products doomed? Will passwords go away forever? Looking at my 1Password database I have … 854 logins and 352 passwords. Seems like a decade at least before password management would decline significantly.

klabb3 4y ago
On the contrary, password managers will be more relevant in the future, because they will be more important for people who don't use a pw manager today (most people aren't very good at 256 bit elliptic curve arithmetic). Even though Apple (and likely a couple more) will provide their proprietary passwordless system with cloud sync, a lot of people don't want to rely on an iCloud account to be your backup in case you lose your phone. Which means that cross platform password managers are in an excellent position to compete in passwordless, since it can span all your devices and browsers. They are already keeping sensitive secrets, integrate with biometrics and device-specific soft-locks, audit logs etc – all they need to do is add some integrations for WebAuthn and certain platform APIs that Apple and friends have to provide. The main adoption-risk with password-less is fallback for when the user's browser isn't fully integrated with a pw-manager. Not that it's impossible, but if you need a backup you now have a multimodal and more complicated system, and if that burden is shifted to individual web/app developers it will certainly delay or even stop the transition.
- karlshea 4y ago
  > Even though Apple (and likely a couple more) will provide their proprietary passwordless system with cloud sync, a lot of people don't want to rely on an iCloud account to be your backup in case you lose your phone. This is the big one for me. The user story for logging in to a site on Windows with an iOS passkey is to scan a QR code with your phone, which sounds obnoxious. I'd rather just have 1Password be the private key repository and those keys will sync to Mac/Windows/Phones through it instead of them being locked into iCloud Keychain, and it can handle logins just like normal.
  - klabb3 4y ago
    Yeah that's why I think pw managers will be central to this story. Apple will try though, and they might have an edge and push the initial adoption, but eventually they'll come around. Their hubris usually calms down when their lock-in plans go further than they can handle. I like Bitwarden more personally, but if the important aspects are standardized it shouldn't really make a difference.
    - herrkanin 4y ago
      Apple already has excellent external password manager support in iOS and macOS, why do you think they will try to lock that down?
      - gumby 4y ago
        Indeed, and Apple's pw manager is, as is typical, just a baseline implementation. I really need a full featured one so I can fix misfires (e.g. sign up on web, but the associated app doesn't set its domain properly), look for duplicates, get the info out for sites that can't auto entry (grr, js validation character-by-character) etc. The calendar is another good example: adequate for many people, but trivially supplanted by a third party app (I use busycal) that apple treats as first class.
  - nisegami 4y ago
    >The user story for logging in to a site on Windows with an iOS passkey is to scan a QR code with your phone, which sounds obnoxious. I've found this flow rather acceptable actually. I usually use it for Discord/Steam.
    - smileybarry 4y ago
      It’s alright but it requires dismissing Windows Hello/FIDO2 every time and relies on establishing a BLE connection every time. (There’s no lasting BLE connection right now) So it’s also currently unusable on my desktop due to lack of Bluetooth. I’d rather Windows Hello maintain a BLE connection itself and implement this (or the password manager suggestion).
- waynesonfire 4y ago
  I think you're underestimating the threat. 1pass saw it and is acquiring a company in that space to figure out how to continue to add value in a password less environment that justifies their annual fees. Not a surprising move. I view 1pass is a secret manager and so it makes sense they add password less to their portfolio. We'll see how things play out.
solatic 4y ago
That's probably why 1Password picked them up. Get strategic coverage while a player like Passage is small and therefore relatively cheap to acquire.
Ferret7446 4y ago
Just like fax machines are going away?
- manarth 4y ago
  https://www.theguardian.com/technology/2022/nov/01/fax-for-the-memories-ofcom-backs-death-warrant-for-80s-office-staple https://www.theguardian.com/technology/2022/nov/01/fax-for-t...
deleted 4y ago
[deleted]
_fat_santa 4y ago
I don't think so, when I look at my 1Password vault, I have way more than just passwords. API keys, secure notes, security questions and anything else I want to keep "secure". I would imagine 1Password would integrate passkeys into it's app just like they did with 2FA.
CatWChainsaw 4y ago
I don't know why passwords would go away forever. The "technology" has existed, imperfect as it is, for thousands of years. Other forms of authentication have their own weaknesses which is why MFA is so important now. If passwords do get largely phased out, I know I'm going to be That One Luddite hanging on to the bitter end...

by tedd4u 4y ago

klabb3 4y ago

On the contrary, password managers will be more relevant in the future, because they will be more important for people who don't use a pw manager today (most people aren't very good at 256 bit elliptic curve arithmetic). Even though Apple (and likely a couple more) will provide their proprietary passwordless system with cloud sync, a lot of people don't want to rely on an iCloud account to be your backup in case you lose your phone. Which means that cross platform password managers are in an excellent position to compete in passwordless, since it can span all your devices and browsers. They are already keeping sensitive secrets, integrate with biometrics and device-specific soft-locks, audit logs etc – all they need to do is add some integrations for WebAuthn and certain platform APIs that Apple and friends have to provide. The main adoption-risk with password-less is fallback for when the user's browser isn't fully integrated with a pw-manager. Not that it's impossible, but if you need a backup you now have a multimodal and more complicated system, and if that burden is shifted to individual web/app developers it will certainly delay or even stop the transition.

karlshea 4y ago
> Even though Apple (and likely a couple more) will provide their proprietary passwordless system with cloud sync, a lot of people don't want to rely on an iCloud account to be your backup in case you lose your phone. This is the big one for me. The user story for logging in to a site on Windows with an iOS passkey is to scan a QR code with your phone, which sounds obnoxious. I'd rather just have 1Password be the private key repository and those keys will sync to Mac/Windows/Phones through it instead of them being locked into iCloud Keychain, and it can handle logins just like normal.
- klabb3 4y ago
  Yeah that's why I think pw managers will be central to this story. Apple will try though, and they might have an edge and push the initial adoption, but eventually they'll come around. Their hubris usually calms down when their lock-in plans go further than they can handle. I like Bitwarden more personally, but if the important aspects are standardized it shouldn't really make a difference.
  - herrkanin 4y ago
    Apple already has excellent external password manager support in iOS and macOS, why do you think they will try to lock that down?
    - gumby 4y ago
      Indeed, and Apple's pw manager is, as is typical, just a baseline implementation. I really need a full featured one so I can fix misfires (e.g. sign up on web, but the associated app doesn't set its domain properly), look for duplicates, get the info out for sites that can't auto entry (grr, js validation character-by-character) etc. The calendar is another good example: adequate for many people, but trivially supplanted by a third party app (I use busycal) that apple treats as first class.
- nisegami 4y ago
  >The user story for logging in to a site on Windows with an iOS passkey is to scan a QR code with your phone, which sounds obnoxious. I've found this flow rather acceptable actually. I usually use it for Discord/Steam.
  - smileybarry 4y ago
    It’s alright but it requires dismissing Windows Hello/FIDO2 every time and relies on establishing a BLE connection every time. (There’s no lasting BLE connection right now) So it’s also currently unusable on my desktop due to lack of Bluetooth. I’d rather Windows Hello maintain a BLE connection itself and implement this (or the password manager suggestion).
waynesonfire 4y ago
I think you're underestimating the threat. 1pass saw it and is acquiring a company in that space to figure out how to continue to add value in a password less environment that justifies their annual fees. Not a surprising move. I view 1pass is a secret manager and so it makes sense they add password less to their portfolio. We'll see how things play out.

solatic 4y ago

That's probably why 1Password picked them up. Get strategic coverage while a player like Passage is small and therefore relatively cheap to acquire.

Ferret7446 4y ago

Just like fax machines are going away?

manarth 4y ago
https://www.theguardian.com/technology/2022/nov/01/fax-for-the-memories-ofcom-backs-death-warrant-for-80s-office-staple https://www.theguardian.com/technology/2022/nov/01/fax-for-t...

deleted 4y ago

[deleted]

_fat_santa 4y ago

I don't think so, when I look at my 1Password vault, I have way more than just passwords. API keys, secure notes, security questions and anything else I want to keep "secure". I would imagine 1Password would integrate passkeys into it's app just like they did with 2FA.

CatWChainsaw 4y ago

I don't know why passwords would go away forever. The "technology" has existed, imperfect as it is, for thousands of years. Other forms of authentication have their own weaknesses which is why MFA is so important now. If passwords do get largely phased out, I know I'm going to be That One Luddite hanging on to the bitter end...