3 ms·

This is all moving a little fast for me. I’ve been a long time user of 1password and to me passwords make sense. My concern, and I don’t see any passkey articl

by mdmglr 4y ago

This is all moving a little fast for me. I’ve been a long time user of 1password and to me passwords make sense. My concern, and I don’t see any passkey articles addressing is: Are passkeys vendor agnostic? A lot of talk is in the context of Apples T2/TouchID. I understand the protocol is open but these implementations don’t seem very open. What if I want to leave 1password and migrate to another vendor? What happens when my device becomes stolen, unrecoverable or sold? What’s happens if an OS level zero day pwns my passkey or Apples T2 chips. Today 1password is all my passwords in a single database file that is encrypted with a key that is derived from 1 password using PBKDF2. I can export it to json. I can move it around. Will I get the same flexibility? I’m not an early adopter- especially when it comes to this type of stuff. If 1password forces these new changes I will be looking for alternatives.

tadfisher 4y ago
Passkeys are a misnomer; it's the same FIDO2 protocol, but the third party is trusting your authenticator for verification, instead of doing that themselves with a password. From what I understand, the big three OS vendors are working on a way to sync private keys, but IMO, it's unnecessary; you should be able to register multiple passkeys per service, just as you can with ordinary FIDO2/WebAuthn credentials, because to the service they are one and the same. For example, you could register a Yubikey and lock it in a safe as your backup. What makes this work is an additional attestation payload the authenticator passes along with a challenge response, and that's what the secure element in TPM, T2, and Yubikey provides. So the question of "how do I save and export my credentials" is kind of moot; they are tied to your devices, they're synced by the authenticator if you want using an additional protocol (the "sync fabric"), and you should be registering backup devices if you're worried.

by mdmglr 4y ago

tadfisher 4y ago

Passkeys are a misnomer; it's the same FIDO2 protocol, but the third party is trusting your authenticator for verification, instead of doing that themselves with a password. From what I understand, the big three OS vendors are working on a way to sync private keys, but IMO, it's unnecessary; you should be able to register multiple passkeys per service, just as you can with ordinary FIDO2/WebAuthn credentials, because to the service they are one and the same. For example, you could register a Yubikey and lock it in a safe as your backup. What makes this work is an additional attestation payload the authenticator passes along with a challenge response, and that's what the secure element in TPM, T2, and Yubikey provides. So the question of "how do I save and export my credentials" is kind of moot; they are tied to your devices, they're synced by the authenticator if you want using an additional protocol (the "sync fabric"), and you should be registering backup devices if you're worried.