6 ms·

Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17_and_macos_14_will_support_3rd_party/ https://reddit.com/r/Bitwarden/comments/14

Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17_and_macos_14_will_support_3rd_party/ https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17... This is big news as vendor lock in and inability to use our own sync was one of the biggest issues bought up whenever Passkeys are discussed. Apple are now allowing external sync fabrics such as password managers.

devsda 3y ago
> Apple are *now* allowing external sync There is no guarantee that this will be permanent. It can be revoked citing x number of reasons. Also, lets wait until the implementation details are available. If it requires providers having a native app on the device where Apple has control on who and what to allow, there's only an illusion of choice.
- cassianoleal 3y ago
  Pretty sure "now" in this context means "starting now". Once people start relying on this, it will take a lot more than just citing reasons to revoke it without causing massive blowback.
  - devsda 3y ago
    I don't mean revoking 3rd party support entirely. We don't know the implementation details yet but if this requires Apple vetting and whitelisting the providers then it can always be revoked for technical, business, political or any other reasons.
    - cassianoleal 3y ago
      I would expect this to be modelled after the API for password managers, in which case there's no vetting or whitelisting. Or if there is, it's pretty open as a lot of software uses it, both closed and open source.
Ajedi32 3y ago
Yeah, this is awesome. The devil's in the details though, do we know anything about exactly how they plan to support external providers? I'm cautiously optimistic; at least on the surface this sounds like exactly what I was hoping for.
- awinter-py 3y ago
  I mean apple has a tried and true playbook for supporting external providers, I'm not worried charge them random % of revenue, force them to funnel all transactions through apple, let random junior employees disable the 3rd party's bugfixes for reasons(tm), and eventually refuse to license new entrants because there are too many flashlight apps I'm not worried
- ezfe 3y ago
  > Password manager apps can save and offer passkeys on iOS, iPadOS, and macOS. No reason to believe this would work differently than the existing affordances for 3rd party apps to offer passwords, which works well today
  - eep_social 3y ago
    So I will be able to copy-paste some string from my password manager to my browser in order to complete the passkey handshake? Or does this mean that my password manager must support my browser of choice on my platform of choice with some opaque plugin that cannot be disabled (eg, 1pw on macos today)?
    - ezfe 3y ago
      On iOS for passwords, this is a systemwide system that allows any app to register as a password provider and any password field to receive those passwords via the system keyboard. I would assume that the system passkey interface will handle the receiving app, and the sharing app will register with the system (NOT with the browser or app, although this doesn't preclude doing that as well) to vend passkeys.
danShumway 3y ago
I'm very eager to see what Bitwarden does here, they're the first big[0] name that's actually Open Source that's on board. It's hard to take passkeys seriously when the vast majority of implementations are completely proprietary. Seeing what Bitwarden comes up with and seeing whether or not the process for self-hosted Bitwarden accounts is actually seamless and works on platforms like desktop Linux -- to me, that's going to be a really big test of whether passkeys can credibly be claimed to be actually cross-platform. [0]: I do think there have been some smaller proof-of-concepts, but... there's a difference of scale here.

devsda 3y ago

> Apple are *now* allowing external sync There is no guarantee that this will be permanent. It can be revoked citing x number of reasons. Also, lets wait until the implementation details are available. If it requires providers having a native app on the device where Apple has control on who and what to allow, there's only an illusion of choice.

cassianoleal 3y ago
Pretty sure "now" in this context means "starting now". Once people start relying on this, it will take a lot more than just citing reasons to revoke it without causing massive blowback.
- devsda 3y ago
  I don't mean revoking 3rd party support entirely. We don't know the implementation details yet but if this requires Apple vetting and whitelisting the providers then it can always be revoked for technical, business, political or any other reasons.
  - cassianoleal 3y ago
    I would expect this to be modelled after the API for password managers, in which case there's no vetting or whitelisting. Or if there is, it's pretty open as a lot of software uses it, both closed and open source.

Ajedi32 3y ago

Yeah, this is awesome. The devil's in the details though, do we know anything about exactly how they plan to support external providers? I'm cautiously optimistic; at least on the surface this sounds like exactly what I was hoping for.

awinter-py 3y ago
I mean apple has a tried and true playbook for supporting external providers, I'm not worried charge them random % of revenue, force them to funnel all transactions through apple, let random junior employees disable the 3rd party's bugfixes for reasons(tm), and eventually refuse to license new entrants because there are too many flashlight apps I'm not worried
ezfe 3y ago
> Password manager apps can save and offer passkeys on iOS, iPadOS, and macOS. No reason to believe this would work differently than the existing affordances for 3rd party apps to offer passwords, which works well today
- eep_social 3y ago
  So I will be able to copy-paste some string from my password manager to my browser in order to complete the passkey handshake? Or does this mean that my password manager must support my browser of choice on my platform of choice with some opaque plugin that cannot be disabled (eg, 1pw on macos today)?
  - ezfe 3y ago
    On iOS for passwords, this is a systemwide system that allows any app to register as a password provider and any password field to receive those passwords via the system keyboard. I would assume that the system passkey interface will handle the receiving app, and the sharing app will register with the system (NOT with the browser or app, although this doesn't preclude doing that as well) to vend passkeys.

danShumway 3y ago

I'm very eager to see what Bitwarden does here, they're the first big[0] name that's actually Open Source that's on board. It's hard to take passkeys seriously when the vast majority of implementations are completely proprietary. Seeing what Bitwarden comes up with and seeing whether or not the process for self-hosted Bitwarden accounts is actually seamless and works on platforms like desktop Linux -- to me, that's going to be a really big test of whether passkeys can credibly be claimed to be actually cross-platform. [0]: I do think there have been some smaller proof-of-concepts, but... there's a difference of scale here.