6 ms·

I still don’t understand why anyone who isn’t in the walled garden business would consent to passkeys.

iknowstuff 3y ago
Because you don't understand passkeys. And you probably don't know password managers can store passkeys as well as the OS
CharlesW 3y ago
Maybe you misunderstand how they work? My GitHub account currently has a 1Password passkey and an Apple passkey. IIRC I added the Apple-generated passkey before 1Password supported them, but both work, and neither prevents me from moving to a different pass* manager in the future. I personally feel safer that passkeys aren't sync'd across multiple vendors' products.
- flkenosad 3y ago
  Are there good open-source, self-hostable alternatives to 1Password that do this?
  - 71a54xd 3y ago
    I'm also still waiting for the answer to this question. No way I'm going to let apple or google control half of my access to everything I use online...
    - sambazi 3y ago
      with google and apple constituting the smartphone duopoly i'd say this is already the case
      - 71a54xd 3y ago
        Yet I can use one of I don't know... 20 different auth providers or a DB that has nothing tied to these companies...
    - CharlesW 3y ago
      FWIW, passkey support doesn't mean that Apple or Google controls anything. It's all standards-based. Use a Yubikey or whatever you like. https://www.yubico.com/resources/glossary/what-is-a-passkey/ https://www.yubico.com/resources/glossary/what-is-a-passkey/
  - samcat116 3y ago
    I think it’s on Bitwarden’s roadmap to be implemented soon
    - gurchik 3y ago
      Supposedly sometime in October.
  - DavideNL 3y ago
    Fyi it’s in the works for KeepassXC: https://github.com/keepassxreboot/keepassxc/issues/1870#issuecomment-1322275148 https://github.com/keepassxreboot/keepassxc/issues/1870#issu...
- yomlica8 3y ago
  > I personally feel safer that passkeys aren't sync'd across multiple vendors' products. Last time I checked into these hardware attestation was part of the specification but the ability export them from a vendors platforms is not. In practice that will mean unapproved platforms can be shut out and walled gardens strengthened. Which will happen sooner or later because it can. Apple supposedly zeroes their attestation but that is only a partial mitigation and relies upon the values of a giant corporation not changing its mind for any host of business reasons. And it does nothing to stop other platforms.
  - kstrauser 3y ago
    I don't know that I've encountered a service that allows exactly one passkey. Everything I've tried either doesn't support passkeys at all, or supports multiple. In the latter case, add an iOS/Android passkey and something separate like a YubiKey. If one gets lost or you stop using it, the other still works.
  - aseipp 3y ago
    FIDO itself specifies that attestation can be used but it's extremely likely browsers aren't going to ever support it for the same reason Apple has publicly said they won't: because attestation is a misfeature for Passkeys, because it completely eliminates the (very important and large) ability to synchronize Passkeys across devices using third party apps or built in browser mechanisms. Having to manually re-enroll every device is like a step backwards 10 years into the past from a usability POV. Device-attestation for passkeys was always 100% DOA for this reason, because without it, they can't form a suitable password replacement in the existing ecosystem, where synchronization is basically expected.
    - yomlica8 3y ago
      Bizarre they would make room in the specification for a DOA misfeature no one is going to use and everyone hates. Why not remove it from the spec and place the requirement of synchronization support into the spec instead?
      - 3y ago
- recursive 3y ago
  > Maybe you misunderstand how they work? For me, it's precisely because I know I don't understand how they work. With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. The test for me is whether I can copy some piece of data out of the password manager and use it to authenticate. If authentication has to "go through" the manager, then my access to my account is vulnerable to the whims of the password manager. Or perhaps the whims of the new corporate owners of the password manager. I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. I'll be holding out either until I can understand satisfactory answers to these, or until support for passwords gets dropped from services I use.
  - phildenhoff 3y ago
    From looking at the 1Password app, exporting Passkeys isn't an option. that's a bit of a usability nightmare IMO, one which I hadn't considered. I'm still strongly in favor of passkeys overall, though. They don't need to be used for every service, but strong, safe, phish-proof asymmetric crypto being used for user auth just makes sense.
  - WA 3y ago
    Good points, maybe 1Password will pull a Unity post-IPO and demand 1 cent per login. Right now, 1Password is really good, but who knows if it'll stay the same.
  - CharlesW 3y ago
    > With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. Fair enough! It still seems a bit like magic when it works. > With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. I'm not sure how a pass[word|key] manager would lock you out of your accounts, but if you don't use password managers for that reason, that same theoretical danger would be true of passkey managers. I don't personally have any of my extremely secure auto-created passwords memorized either, so for me a passkey is not different in that respect. If I inadvertently delete a pass[word|key], I'll have to go through the "forgot my password" process. Within 5 years, I can imagine services without password support. I'd expect that in "lost passkey" cases, those services will support allowing you to log in with a one-time code sent to your registered email address (or SMS) and/or with backup codes. > I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. Here's a real-world example: I played with Apple's passkey support before 1Password's passkey support was available. When 1Password added passkey support, I added another passkey to the sites that supported it and called it "1Password". And here's what it looks like when your Google account has 3 passkeys: https://imgur.com/a/NQl8XPI https://imgur.com/a/NQl8XPI
thewataccount 3y ago
From my understanding they're basically an extension of FIDO? You can just use a yubikey unless I'm mistaken?
- spoiler 3y ago
  > You can just use a yubikey unless I'm mistaken? Yes, USB passkeys work!
- 0x457 3y ago
  Something like that, they're Webauthn alternative outside the web and allows multi-device syncing (Webauthn doesn't support syncing) You could use any FIDO2 software or hardware key with Passkey.
Arnavion 3y ago
A password manager can easily implement passkeys just like it implements passwords. Though last I checked no browser had created an API for extensions to implement the passkey API. KeepassXC's implementation for example has to inject JS into every page to override `window.navigator.credentials` ( https://github.com/keepassxreboot/keepassxc-browser/pull/1786 https://github.com/keepassxreboot/keepassxc-browser/pull/178... ). It works but is brittle, so a proper way through extension API would be nice.
- coder543 3y ago
  I can’t speak to other platforms, but iOS natively integrates with third party password managers for passkey support, including inside Safari.
- samcat116 3y ago
  The 1Password extension in Chrome does this so I assume there is some API
  - varjolintu 3y ago
    Every password manager browser extension does a similar injection, including 1Password.
- aseipp 3y ago
  It's a really recent addition to Chrome/Edge to support that, and it only was supported on iOS in v17 which came out last week. Actually, 1Password probably released their support for Passkeys last week precisely because iOS 17 was finally out. For reference, I just 5 minutes ago opened GitHub in Edge on my iOS device, clicked "Sign in with Passkey", and 1Password correctly popped up and offered to sign in with the passkey I had created in Edge on my desktop. I then opened Safari on my phone, and did the same thing. So it definitely is getting there.
  - deleted 3y ago
    [deleted]
- 3y ago
heavyset_go 3y ago
If your only exposure to passkeys is through their Android and iOS implementations, I could understand this initial reaction, but they don't only exist on Android and iOS. It's entirely possible to use passkeys outside of either platform by using any FIDO2 security key with discoverable key storage. There are even existing open source apps that emulate FIDO2 security keys that you can use. I also believe that passkeys can be backed up and exported on Android/iOS, either now or sometime in the future. The FIDO Alliance is working on standardizing the backup and transfer of passkeys so that they can be exported and used however you see fit. That said, I don't use the Android or iOS implementation of passkeys and probably never will. It's possible to use passkeys without ever giving closed platforms the keys to your castle.

Because you don't understand passkeys. And you probably don't know password managers can store passkeys as well as the OS

CharlesW 3y ago

Maybe you misunderstand how they work? My GitHub account currently has a 1Password passkey and an Apple passkey. IIRC I added the Apple-generated passkey before 1Password supported them, but both work, and neither prevents me from moving to a different pass* manager in the future. I personally feel safer that passkeys aren't sync'd across multiple vendors' products.

flkenosad 3y ago
Are there good open-source, self-hostable alternatives to 1Password that do this?
- 71a54xd 3y ago
  I'm also still waiting for the answer to this question. No way I'm going to let apple or google control half of my access to everything I use online...
  - sambazi 3y ago
    with google and apple constituting the smartphone duopoly i'd say this is already the case
    - 71a54xd 3y ago
      Yet I can use one of I don't know... 20 different auth providers or a DB that has nothing tied to these companies...
  - CharlesW 3y ago
    FWIW, passkey support doesn't mean that Apple or Google controls anything. It's all standards-based. Use a Yubikey or whatever you like. https://www.yubico.com/resources/glossary/what-is-a-passkey/ https://www.yubico.com/resources/glossary/what-is-a-passkey/
- samcat116 3y ago
  I think it’s on Bitwarden’s roadmap to be implemented soon
  - gurchik 3y ago
    Supposedly sometime in October.
- DavideNL 3y ago
  Fyi it’s in the works for KeepassXC: https://github.com/keepassxreboot/keepassxc/issues/1870#issuecomment-1322275148 https://github.com/keepassxreboot/keepassxc/issues/1870#issu...
yomlica8 3y ago
> I personally feel safer that passkeys aren't sync'd across multiple vendors' products. Last time I checked into these hardware attestation was part of the specification but the ability export them from a vendors platforms is not. In practice that will mean unapproved platforms can be shut out and walled gardens strengthened. Which will happen sooner or later because it can. Apple supposedly zeroes their attestation but that is only a partial mitigation and relies upon the values of a giant corporation not changing its mind for any host of business reasons. And it does nothing to stop other platforms.
- kstrauser 3y ago
  I don't know that I've encountered a service that allows exactly one passkey. Everything I've tried either doesn't support passkeys at all, or supports multiple. In the latter case, add an iOS/Android passkey and something separate like a YubiKey. If one gets lost or you stop using it, the other still works.
- aseipp 3y ago
  FIDO itself specifies that attestation can be used but it's extremely likely browsers aren't going to ever support it for the same reason Apple has publicly said they won't: because attestation is a misfeature for Passkeys, because it completely eliminates the (very important and large) ability to synchronize Passkeys across devices using third party apps or built in browser mechanisms. Having to manually re-enroll every device is like a step backwards 10 years into the past from a usability POV. Device-attestation for passkeys was always 100% DOA for this reason, because without it, they can't form a suitable password replacement in the existing ecosystem, where synchronization is basically expected.
  - yomlica8 3y ago
    Bizarre they would make room in the specification for a DOA misfeature no one is going to use and everyone hates. Why not remove it from the spec and place the requirement of synchronization support into the spec instead?
    - 3y ago
recursive 3y ago
> Maybe you misunderstand how they work? For me, it's precisely because I know I don't understand how they work. With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. The test for me is whether I can copy some piece of data out of the password manager and use it to authenticate. If authentication has to "go through" the manager, then my access to my account is vulnerable to the whims of the password manager. Or perhaps the whims of the new corporate owners of the password manager. I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. I'll be holding out either until I can understand satisfactory answers to these, or until support for passwords gets dropped from services I use.
- phildenhoff 3y ago
  From looking at the 1Password app, exporting Passkeys isn't an option. that's a bit of a usability nightmare IMO, one which I hadn't considered. I'm still strongly in favor of passkeys overall, though. They don't need to be used for every service, but strong, safe, phish-proof asymmetric crypto being used for user auth just makes sense.
- WA 3y ago
  Good points, maybe 1Password will pull a Unity post-IPO and demand 1 cent per login. Right now, 1Password is really good, but who knows if it'll stay the same.
- CharlesW 3y ago
  > With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. Fair enough! It still seems a bit like magic when it works. > With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. I'm not sure how a pass[word|key] manager would lock you out of your accounts, but if you don't use password managers for that reason, that same theoretical danger would be true of passkey managers. I don't personally have any of my extremely secure auto-created passwords memorized either, so for me a passkey is not different in that respect. If I inadvertently delete a pass[word|key], I'll have to go through the "forgot my password" process. Within 5 years, I can imagine services without password support. I'd expect that in "lost passkey" cases, those services will support allowing you to log in with a one-time code sent to your registered email address (or SMS) and/or with backup codes. > I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. Here's a real-world example: I played with Apple's passkey support before 1Password's passkey support was available. When 1Password added passkey support, I added another passkey to the sites that supported it and called it "1Password". And here's what it looks like when your Google account has 3 passkeys: https://imgur.com/a/NQl8XPI https://imgur.com/a/NQl8XPI

thewataccount 3y ago

From my understanding they're basically an extension of FIDO? You can just use a yubikey unless I'm mistaken?

spoiler 3y ago
> You can just use a yubikey unless I'm mistaken? Yes, USB passkeys work!
0x457 3y ago
Something like that, they're Webauthn alternative outside the web and allows multi-device syncing (Webauthn doesn't support syncing) You could use any FIDO2 software or hardware key with Passkey.

Arnavion 3y ago

A password manager can easily implement passkeys just like it implements passwords. Though last I checked no browser had created an API for extensions to implement the passkey API. KeepassXC's implementation for example has to inject JS into every page to override `window.navigator.credentials` ( https://github.com/keepassxreboot/keepassxc-browser/pull/1786 https://github.com/keepassxreboot/keepassxc-browser/pull/178... ). It works but is brittle, so a proper way through extension API would be nice.

coder543 3y ago
I can’t speak to other platforms, but iOS natively integrates with third party password managers for passkey support, including inside Safari.
samcat116 3y ago
The 1Password extension in Chrome does this so I assume there is some API
- varjolintu 3y ago
  Every password manager browser extension does a similar injection, including 1Password.
aseipp 3y ago
It's a really recent addition to Chrome/Edge to support that, and it only was supported on iOS in v17 which came out last week. Actually, 1Password probably released their support for Passkeys last week precisely because iOS 17 was finally out. For reference, I just 5 minutes ago opened GitHub in Edge on my iOS device, clicked "Sign in with Passkey", and 1Password correctly popped up and offered to sign in with the passkey I had created in Edge on my desktop. I then opened Safari on my phone, and did the same thing. So it definitely is getting there.
- deleted 3y ago
  [deleted]
3y ago

heavyset_go 3y ago

If your only exposure to passkeys is through their Android and iOS implementations, I could understand this initial reaction, but they don't only exist on Android and iOS. It's entirely possible to use passkeys outside of either platform by using any FIDO2 security key with discoverable key storage. There are even existing open source apps that emulate FIDO2 security keys that you can use. I also believe that passkeys can be backed up and exported on Android/iOS, either now or sometime in the future. The FIDO Alliance is working on standardizing the backup and transfer of passkeys so that they can be exported and used however you see fit. That said, I don't use the Android or iOS implementation of passkeys and probably never will. It's possible to use passkeys without ever giving closed platforms the keys to your castle.