5 ms·

My reaction as well. From Google's FAQ: > Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Accou

My reaction as well. From Google's FAQ: > Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager. I don't like this. Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration. I certainly don't like the lack of emphasis on interoperability from the get go. I do not like this future.

jacooper 4y ago
AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. Also it seems that Linux is completely out of the picture.
- dwaite 4y ago
  > AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. The Android implementation allowing for multiple third part passkey providers (typically, existing password manager that want to support passkeys) is in beta. Apple does not pre-announce features, so we are all likely in the dark on their timelines, and whether their timelines extend to infinity. However, I believe a passkey manager can replace the system implementation via the web extension mechanism in mobile Safari today.
- chlorion 4y ago
  You can use passkeys from a FOSS client on Linux, you can even use your Yubikey if you have one.
  - mastazi 4y ago
    just because there are APIs that a FOSS client can call, that doesn't guarantee interoperabiltiy.
dwaite 4y ago
> Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration It is all user terminology for Web Authentication features, so credentials stored on a current Yubikey are also "passkeys". There are multiple open source security key hardware implementations that support the published specs. There are multiple password managers that have started to implement "passkey manager" functionality - 1Password and Dashlane have made announcements here and have published code and Web Extensions for desktop. Android 14 beta has a system API where software providers such as 1Password and Dashlane can work with this system, not just for Chrome but for installed applications. I doubt Google's Password Manager will ever be open sourced, but it doesn't need to be for an interoperable ecosystem.
- internetter 4y ago
  Thank you didn't know this! I just hope the underdog can stand a chance against the "it just comes with it"
  - dwaite 4y ago
    I do too. The ability for a smaller focused company to innovate and pivot to find unique markets is way different than what the platforms will ever offer. I suspect passkeys provide new ways to innovate beyond what they have been able to do with passwords in the past. Assuming there is an ecosystem where they can play equally, I suspect they will find all sorts of ways to provide unique value. Their goal shouldn't to be the preferred system across all of Android or iOS, but to offer something a lot of people are willing to pay for.
- mastazi 4y ago
  > but it doesn't need to be for an interoperable ecosystem. what you described above doesn't guarantee that the ecosystem is interoperable. With passwords, there is no way for the service provider to hide the cleartext password from you, this is inherent to the way passwords work. With passkey, a service provider could decide to hide the private keys from you, effectively locking you into their ecosystem, and there is nothing you could do to avoid this.
cultureswitch 4y ago
The thing with these authentication services is that if Google doesn't like you and blocks your account, you're fucked. This is not a remote possibility. It happens to thousands of people every day, for entirely frivolous reasons. Until there is some authentication system that is genuinely robust to corporate control attacks, I'll keep using the imperfect password manager model.

jacooper 4y ago

AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. Also it seems that Linux is completely out of the picture.

dwaite 4y ago
> AFAIK android will have an open API, iOS however is going to only support iCloud, classic monopoly. The Android implementation allowing for multiple third part passkey providers (typically, existing password manager that want to support passkeys) is in beta. Apple does not pre-announce features, so we are all likely in the dark on their timelines, and whether their timelines extend to infinity. However, I believe a passkey manager can replace the system implementation via the web extension mechanism in mobile Safari today.
chlorion 4y ago
You can use passkeys from a FOSS client on Linux, you can even use your Yubikey if you have one.
- mastazi 4y ago
  just because there are APIs that a FOSS client can call, that doesn't guarantee interoperabiltiy.

dwaite 4y ago

> Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration It is all user terminology for Web Authentication features, so credentials stored on a current Yubikey are also "passkeys". There are multiple open source security key hardware implementations that support the published specs. There are multiple password managers that have started to implement "passkey manager" functionality - 1Password and Dashlane have made announcements here and have published code and Web Extensions for desktop. Android 14 beta has a system API where software providers such as 1Password and Dashlane can work with this system, not just for Chrome but for installed applications. I doubt Google's Password Manager will ever be open sourced, but it doesn't need to be for an interoperable ecosystem.

internetter 4y ago
Thank you didn't know this! I just hope the underdog can stand a chance against the "it just comes with it"
- dwaite 4y ago
  I do too. The ability for a smaller focused company to innovate and pivot to find unique markets is way different than what the platforms will ever offer. I suspect passkeys provide new ways to innovate beyond what they have been able to do with passwords in the past. Assuming there is an ecosystem where they can play equally, I suspect they will find all sorts of ways to provide unique value. Their goal shouldn't to be the preferred system across all of Android or iOS, but to offer something a lot of people are willing to pay for.
mastazi 4y ago
> but it doesn't need to be for an interoperable ecosystem. what you described above doesn't guarantee that the ecosystem is interoperable. With passwords, there is no way for the service provider to hide the cleartext password from you, this is inherent to the way passwords work. With passkey, a service provider could decide to hide the private keys from you, effectively locking you into their ecosystem, and there is nothing you could do to avoid this.

cultureswitch 4y ago

The thing with these authentication services is that if Google doesn't like you and blocks your account, you're fucked. This is not a remote possibility. It happens to thousands of people every day, for entirely frivolous reasons. Until there is some authentication system that is genuinely robust to corporate control attacks, I'll keep using the imperfect password manager model.