Hi, I'm the author of the blogpost. You are spot on, Passkeys are exportable so the private key ends up both on iCloud and the Enclave/authenticator. My under

Hi, I'm the author of the blogpost. You are spot on, Passkeys are exportable so the private key ends up both on iCloud and the Enclave/authenticator. My understanding is that there's chatter about cross-vendor synchronization of passkeys but nothing concrete yet. Meanwhile Apple allows people to share Passkeys via AirDrop (Settings > Passwords - select the passkey you want and click the "Share" icon to send it over Airdrop) so it should be possible with some effort to obtain the private key with something like this: https://github.com/seemoo-lab/opendrop https://github.com/seemoo-lab/opendrop. Haven't done extensive testing yet though, so I can't confirm. Would love to hear if anybody knows more about how the sharing via AirDrop is implemented/protected.