3 ms·

Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out

Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out.

danShumway 4y ago
This is not really the same thing as what GP is asking? They're asking about backing up existing keys, you're talking about creating new ones. I can back up my entire password database just by copying a file. To "back up" a Yubikey I buy a new key then I individually visit every single site I have an account on and attach a new key one by one. That's not equivalent. It also makes setup a lot less convenient than a password manager would be. Every time I set up an account I need to set up two devices? And ideally they should be stored in different places, just having 2 Yubikeys in my pocket isn't really doing much for me, so now every signup is literally a 2-step process that involves going to 2 locations. "Just" is doing a lot of work here.
- tadfisher 4y ago
  You are describing the tradeoff made by passkeys, yes. The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Luckily, passkey "syncing" and "backup" means issuing a new key that's signed by an old key, so you can in fact have the convenience of paper-based backups if you want (that's how the QR codes work for syncing between passkey managers). I trust you can appreciate how this improves security in general, by trading some convenience.
  - pabs3 3y ago
    Would be nice if there were something like pass-otp for passkeys :)
  - danShumway 4y ago
    > The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Passkeys don't live only on the device. iOS syncs to the cloud. They're not unphishable. You can lose your iPhone, get a new iPhone and get all of your passkey logins without having access to the old iPhone. If someone tricks you into giving access to your iCloud account, they can get your passkeys. Heck, if someone tricks you into doing an airdrop, they can get a passkey from you. The whole "these are locked to the device" ship has very much sailed at this point. That's a conscious compromise to security because Apple has decided (I think correctly) that the security gain from blocking backup to the cloud is not actually high enough to justify how much less accessible passkeys would be without that feature. So I don't buy that it's security that's blocking them from also allowing syncing to other places other than iCloud. > You are describing the tradeoff made by passkeys, yes. More to the point though, I wish people would lead with this and not start out by saying, "oh, they're just as portable and easy to back up as a normal password." They're not, there's a tradeoff here. You can not just make an encrypted vault of all of your passkeys and stick that on a USB drive. And that's a tradeoff that was so severe that every major OS provider got together and extended the standard to allow cloud sync for keys. Should they have done that? :shrug: But if someone is asking if they can do the same thing with passkeys that they do with their password manager, the answer is 'no'. You can not export all of your passkeys to an encrypted vault and stick it on a flash drive or sync it to another device using syncthing. Your options are a lot more limited, and the way it's advised to get around that is to authenticate multiple devices for each account. In theory it's something that might be supported in the future? In practice, it's not supported by anyone right now.
    - dcow 4y ago
      > They're not, there's a tradeoff here. You can not just make an encrypted vault of all of your passkeys and stick that on a USB drive. And that's a tradeoff that was so severe that every major OS provider got together and extended the standard to allow cloud sync for keys. Why do the blessed vendors get to do that but not 3rd parties? Syncing your passkeys is just copying the DB to the cloud and then down to another device. If you made a copy of your icloud db, and icloud let you import passkeys (does it?) then you can absolutely make a copy of your icloud keychain and backup/restore it as needed. I don't really understand your point here (everything else checks out though).
  - deleted 4y ago
    [deleted]
  - JohnFen 4y ago
    > because lives on a piece of hardware But it doesn't, unless you opt to use something like a Yubikey, right? I mean, you can sync passkeys through the cloud...
    - NikolaNovak 4y ago
      I think there's a difference between being able to backup a file (like I can with keepass password database) to any device,format or location I choose, vs backup my iPhone to Icloud,because for all intents and purposes that's just secondary memory/storage for my one device. My wife recognizes the scream from the home office when I try to move ANYTHING from my iPhone to anything else in the world. I have no doubt that backing up the pass keys from iPhone / ICloud to a thumb drive or my windows pc would lead to even more primeval shrieks. So I feel those pass keys are pretty stuck to that device in practical ways that matter. Let me know if I'm wrong!
  - NikolaNovak 4y ago
    Wait So I genuinely cannot backup my own pass keys? Like, I cannot say "export to file" and put that on a thumb drive and put that in a safe? Make what copies I want? What kind of dystopian twilight zone where literally "all your base are belong to Apple" (or google or Ms, pick your poison of "choice") we seem to be sliding into?
    - danShumway 4y ago
      > Like, I cannot say "export to file" and put that on a thumb drive and put that in a safe? Make what copies I want? You can not export to file or store a passkey on a thumb drive. There have been a couple of claims from various sources that this is coming sometime(tm), but no official word from any of the larger players. I will believe it when I see it. In addition, if someone does build an Open Source authenticator app that allows you to export and import your keys, there's a capability called hardware attestation that allows login providers to ban authenticators, so there's no guarantee your Open Source authenticator will actually work with every site you want to make an account on. Think of that like going to log into your bank and being told you can't log in because you're storing your password in Bitwarden instead of the Apple password manager. The current way the spec deals with this risk is by asking very politely for companies to not do that unless they have a really good reason.
JohnFen 4y ago
I'm aware of that, yes, but that doesn't really address my question (or use case).

Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out.

danShumway 4y ago

This is not really the same thing as what GP is asking? They're asking about backing up existing keys, you're talking about creating new ones. I can back up my entire password database just by copying a file. To "back up" a Yubikey I buy a new key then I individually visit every single site I have an account on and attach a new key one by one. That's not equivalent. It also makes setup a lot less convenient than a password manager would be. Every time I set up an account I need to set up two devices? And ideally they should be stored in different places, just having 2 Yubikeys in my pocket isn't really doing much for me, so now every signup is literally a 2-step process that involves going to 2 locations. "Just" is doing a lot of work here.

tadfisher 4y ago
You are describing the tradeoff made by passkeys, yes. The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Luckily, passkey "syncing" and "backup" means issuing a new key that's signed by an old key, so you can in fact have the convenience of paper-based backups if you want (that's how the QR codes work for syncing between passkey managers). I trust you can appreciate how this improves security in general, by trading some convenience.
- pabs3 3y ago
  Would be nice if there were something like pass-otp for passkeys :)
- danShumway 4y ago
  > The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Passkeys don't live only on the device. iOS syncs to the cloud. They're not unphishable. You can lose your iPhone, get a new iPhone and get all of your passkey logins without having access to the old iPhone. If someone tricks you into giving access to your iCloud account, they can get your passkeys. Heck, if someone tricks you into doing an airdrop, they can get a passkey from you. The whole "these are locked to the device" ship has very much sailed at this point. That's a conscious compromise to security because Apple has decided (I think correctly) that the security gain from blocking backup to the cloud is not actually high enough to justify how much less accessible passkeys would be without that feature. So I don't buy that it's security that's blocking them from also allowing syncing to other places other than iCloud. > You are describing the tradeoff made by passkeys, yes. More to the point though, I wish people would lead with this and not start out by saying, "oh, they're just as portable and easy to back up as a normal password." They're not, there's a tradeoff here. You can not just make an encrypted vault of all of your passkeys and stick that on a USB drive. And that's a tradeoff that was so severe that every major OS provider got together and extended the standard to allow cloud sync for keys. Should they have done that? :shrug: But if someone is asking if they can do the same thing with passkeys that they do with their password manager, the answer is 'no'. You can not export all of your passkeys to an encrypted vault and stick it on a flash drive or sync it to another device using syncthing. Your options are a lot more limited, and the way it's advised to get around that is to authenticate multiple devices for each account. In theory it's something that might be supported in the future? In practice, it's not supported by anyone right now.
  - dcow 4y ago
    > They're not, there's a tradeoff here. You can not just make an encrypted vault of all of your passkeys and stick that on a USB drive. And that's a tradeoff that was so severe that every major OS provider got together and extended the standard to allow cloud sync for keys. Why do the blessed vendors get to do that but not 3rd parties? Syncing your passkeys is just copying the DB to the cloud and then down to another device. If you made a copy of your icloud db, and icloud let you import passkeys (does it?) then you can absolutely make a copy of your icloud keychain and backup/restore it as needed. I don't really understand your point here (everything else checks out though).
- deleted 4y ago
  [deleted]
- JohnFen 4y ago
  > because lives on a piece of hardware But it doesn't, unless you opt to use something like a Yubikey, right? I mean, you can sync passkeys through the cloud...
  - NikolaNovak 4y ago
    I think there's a difference between being able to backup a file (like I can with keepass password database) to any device,format or location I choose, vs backup my iPhone to Icloud,because for all intents and purposes that's just secondary memory/storage for my one device. My wife recognizes the scream from the home office when I try to move ANYTHING from my iPhone to anything else in the world. I have no doubt that backing up the pass keys from iPhone / ICloud to a thumb drive or my windows pc would lead to even more primeval shrieks. So I feel those pass keys are pretty stuck to that device in practical ways that matter. Let me know if I'm wrong!
- NikolaNovak 4y ago
  Wait So I genuinely cannot backup my own pass keys? Like, I cannot say "export to file" and put that on a thumb drive and put that in a safe? Make what copies I want? What kind of dystopian twilight zone where literally "all your base are belong to Apple" (or google or Ms, pick your poison of "choice") we seem to be sliding into?
  - danShumway 4y ago
    > Like, I cannot say "export to file" and put that on a thumb drive and put that in a safe? Make what copies I want? You can not export to file or store a passkey on a thumb drive. There have been a couple of claims from various sources that this is coming sometime(tm), but no official word from any of the larger players. I will believe it when I see it. In addition, if someone does build an Open Source authenticator app that allows you to export and import your keys, there's a capability called hardware attestation that allows login providers to ban authenticators, so there's no guarantee your Open Source authenticator will actually work with every site you want to make an account on. Think of that like going to log into your bank and being told you can't log in because you're storing your password in Bitwarden instead of the Apple password manager. The current way the spec deals with this risk is by asking very politely for companies to not do that unless they have a really good reason.

JohnFen 4y ago

I'm aware of that, yes, but that doesn't really address my question (or use case).