3 ms·

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK a

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example will encourage other popular password managers to do the same. (...or at least, I think "passkey support" means they plan to support storing passkeys in Bitwarden itself. I hope it doesn't just mean they want to let you use a passkey to log in to Bitwarden. That'd be really disappointing, and probably a poor choice strategically given that passkeys aim to eventually render traditional password managers obsolete.)

noahtallen 4y ago
1Password is also working on it: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ It’s shaping up to be a cool year for password management!
cmdli 4y ago
Shameless plug to my own passkey manager, which is 100% open source: https://bulwark.id https://bulwark.id One of the big challenges to passkeys right now is that they aren’t as versatile as passwords, but this doesn’t have to be the case. Passkeys should be able to be exported and stored anywhere you want (ideally in an open source solution). Bulwark Passkey supports that right now, but I’m glad that other products are also providing solutions to users for the same problem.
- wkat4242 4y ago
  The problem is that big companies don't want them to be as versatile. They don't trust us to manage our credentials. Hence FIDO2 and Passkeys feature 'attestation' that allows them to only accept 'trusted' implementations. This accreditation is a crypto process so it can't be faked. So, you can't just put your keys in any app you wish, like you can with TOTP. There will be strong pressure to just 'go with the flow' eg mainstream OS implementations and us with niche OS or cross platform requirements will be ever more marginalized. Any complaints will be simply rebuked with "For security reasons" or "We only certify implementation X, Y and Z". My work is already doing this, they only support Yubikey and one other brand through their Identity Provider, if you have one of the open source tokens you're straight out of luck. Passkeys don't work yet either but I'm sure they will only 'certify' Apple and Microsoft and leave the rest hanging. They love quoting the pareto principle / 80/20 rule as an excuse.
  - CMCDragonkai 4y ago
    This sounds like an antitrust issue. Similar to Microsoft windows and the explorer browser.
cco 4y ago
> That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. Something that we're looking to solve at Stytch[1] from the developer's perspective. We're finding that the different platforms have their own twist on Passkeys implementation and all have different UX suggestions. [1] https://stytch.com/ https://stytch.com/
dcow 4y ago
It's easy enough (not to belittle efforts that have done so) to store Passkeys in a password manager. The part that kills the flow and where it gets nefarious, though, is whether platform and browser players (Apple/Google/Microsoft/Mozilla) will allow 3rd party Passkey implementations to be selected/configured by the user as their preferred WebAuthN backend so that you can use your 3rd party implementation at login time when the website or app the user is using wants to begin a webauthn flow and lookup or create credentials. Google said they plan to play nice and support 3rd party implementations. When I asked Apple during their Slack Q&A event on Passkeys they said that have no plans to support 3rd party implementations at the moment. I don't know how Microsoft and Mozilla feel. I would be a lot more optimistic about the whole thing if platform players would come out and commit to allowing 3rd party Passkey managers. Otherwise you'll never be an option in the system "choose which credential to use" dialog when some website/app wants to actually do webauthn.
dwaite 4y ago
> That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS… 1Password and Dashlane have both announced support for generating/using passkeys via their browser extensions. It is a good thing that bitwarden is looking at this too.

noahtallen 4y ago

1Password is also working on it: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ It’s shaping up to be a cool year for password management!

cmdli 4y ago

Shameless plug to my own passkey manager, which is 100% open source: https://bulwark.id https://bulwark.id One of the big challenges to passkeys right now is that they aren’t as versatile as passwords, but this doesn’t have to be the case. Passkeys should be able to be exported and stored anywhere you want (ideally in an open source solution). Bulwark Passkey supports that right now, but I’m glad that other products are also providing solutions to users for the same problem.

wkat4242 4y ago
The problem is that big companies don't want them to be as versatile. They don't trust us to manage our credentials. Hence FIDO2 and Passkeys feature 'attestation' that allows them to only accept 'trusted' implementations. This accreditation is a crypto process so it can't be faked. So, you can't just put your keys in any app you wish, like you can with TOTP. There will be strong pressure to just 'go with the flow' eg mainstream OS implementations and us with niche OS or cross platform requirements will be ever more marginalized. Any complaints will be simply rebuked with "For security reasons" or "We only certify implementation X, Y and Z". My work is already doing this, they only support Yubikey and one other brand through their Identity Provider, if you have one of the open source tokens you're straight out of luck. Passkeys don't work yet either but I'm sure they will only 'certify' Apple and Microsoft and leave the rest hanging. They love quoting the pareto principle / 80/20 rule as an excuse.
- CMCDragonkai 4y ago
  This sounds like an antitrust issue. Similar to Microsoft windows and the explorer browser.

cco 4y ago

> That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. Something that we're looking to solve at Stytch[1] from the developer's perspective. We're finding that the different platforms have their own twist on Passkeys implementation and all have different UX suggestions. [1] https://stytch.com/ https://stytch.com/

dcow 4y ago

It's easy enough (not to belittle efforts that have done so) to store Passkeys in a password manager. The part that kills the flow and where it gets nefarious, though, is whether platform and browser players (Apple/Google/Microsoft/Mozilla) will allow 3rd party Passkey implementations to be selected/configured by the user as their preferred WebAuthN backend so that you can use your 3rd party implementation at login time when the website or app the user is using wants to begin a webauthn flow and lookup or create credentials. Google said they plan to play nice and support 3rd party implementations. When I asked Apple during their Slack Q&A event on Passkeys they said that have no plans to support 3rd party implementations at the moment. I don't know how Microsoft and Mozilla feel. I would be a lot more optimistic about the whole thing if platform players would come out and commit to allowing 3rd party Passkey managers. Otherwise you'll never be an option in the system "choose which credential to use" dialog when some website/app wants to actually do webauthn.

dwaite 4y ago

> That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS… 1Password and Dashlane have both announced support for generating/using passkeys via their browser extensions. It is a good thing that bitwarden is looking at this too.