5 ms·

Maybe you misunderstand how they work? My GitHub account currently has a 1Password passkey and an Apple passkey. IIRC I added the Apple-generated passkey befor

Maybe you misunderstand how they work? My GitHub account currently has a 1Password passkey and an Apple passkey. IIRC I added the Apple-generated passkey before 1Password supported them, but both work, and neither prevents me from moving to a different pass* manager in the future. I personally feel safer that passkeys aren't sync'd across multiple vendors' products.

flkenosad 3y ago
Are there good open-source, self-hostable alternatives to 1Password that do this?
- 71a54xd 3y ago
  I'm also still waiting for the answer to this question. No way I'm going to let apple or google control half of my access to everything I use online...
  - sambazi 3y ago
    with google and apple constituting the smartphone duopoly i'd say this is already the case
    - 71a54xd 3y ago
      Yet I can use one of I don't know... 20 different auth providers or a DB that has nothing tied to these companies...
  - CharlesW 3y ago
    FWIW, passkey support doesn't mean that Apple or Google controls anything. It's all standards-based. Use a Yubikey or whatever you like. https://www.yubico.com/resources/glossary/what-is-a-passkey/ https://www.yubico.com/resources/glossary/what-is-a-passkey/
- samcat116 3y ago
  I think it’s on Bitwarden’s roadmap to be implemented soon
  - gurchik 3y ago
    Supposedly sometime in October.
- DavideNL 3y ago
  Fyi it’s in the works for KeepassXC: https://github.com/keepassxreboot/keepassxc/issues/1870#issuecomment-1322275148 https://github.com/keepassxreboot/keepassxc/issues/1870#issu...
yomlica8 3y ago
> I personally feel safer that passkeys aren't sync'd across multiple vendors' products. Last time I checked into these hardware attestation was part of the specification but the ability export them from a vendors platforms is not. In practice that will mean unapproved platforms can be shut out and walled gardens strengthened. Which will happen sooner or later because it can. Apple supposedly zeroes their attestation but that is only a partial mitigation and relies upon the values of a giant corporation not changing its mind for any host of business reasons. And it does nothing to stop other platforms.
- kstrauser 3y ago
  I don't know that I've encountered a service that allows exactly one passkey. Everything I've tried either doesn't support passkeys at all, or supports multiple. In the latter case, add an iOS/Android passkey and something separate like a YubiKey. If one gets lost or you stop using it, the other still works.
- aseipp 3y ago
  FIDO itself specifies that attestation can be used but it's extremely likely browsers aren't going to ever support it for the same reason Apple has publicly said they won't: because attestation is a misfeature for Passkeys, because it completely eliminates the (very important and large) ability to synchronize Passkeys across devices using third party apps or built in browser mechanisms. Having to manually re-enroll every device is like a step backwards 10 years into the past from a usability POV. Device-attestation for passkeys was always 100% DOA for this reason, because without it, they can't form a suitable password replacement in the existing ecosystem, where synchronization is basically expected.
  - yomlica8 3y ago
    Bizarre they would make room in the specification for a DOA misfeature no one is going to use and everyone hates. Why not remove it from the spec and place the requirement of synchronization support into the spec instead?
    - 3y ago
recursive 3y ago
> Maybe you misunderstand how they work? For me, it's precisely because I know I don't understand how they work. With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. The test for me is whether I can copy some piece of data out of the password manager and use it to authenticate. If authentication has to "go through" the manager, then my access to my account is vulnerable to the whims of the password manager. Or perhaps the whims of the new corporate owners of the password manager. I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. I'll be holding out either until I can understand satisfactory answers to these, or until support for passwords gets dropped from services I use.
- phildenhoff 3y ago
  From looking at the 1Password app, exporting Passkeys isn't an option. that's a bit of a usability nightmare IMO, one which I hadn't considered. I'm still strongly in favor of passkeys overall, though. They don't need to be used for every service, but strong, safe, phish-proof asymmetric crypto being used for user auth just makes sense.
- WA 3y ago
  Good points, maybe 1Password will pull a Unity post-IPO and demand 1 cent per login. Right now, 1Password is really good, but who knows if it'll stay the same.
- CharlesW 3y ago
  > With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. Fair enough! It still seems a bit like magic when it works. > With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. I'm not sure how a pass[word|key] manager would lock you out of your accounts, but if you don't use password managers for that reason, that same theoretical danger would be true of passkey managers. I don't personally have any of my extremely secure auto-created passwords memorized either, so for me a passkey is not different in that respect. If I inadvertently delete a pass[word|key], I'll have to go through the "forgot my password" process. Within 5 years, I can imagine services without password support. I'd expect that in "lost passkey" cases, those services will support allowing you to log in with a one-time code sent to your registered email address (or SMS) and/or with backup codes. > I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. Here's a real-world example: I played with Apple's passkey support before 1Password's passkey support was available. When 1Password added passkey support, I added another passkey to the sites that supported it and called it "1Password". And here's what it looks like when your Google account has 3 passkeys: https://imgur.com/a/NQl8XPI https://imgur.com/a/NQl8XPI

flkenosad 3y ago

Are there good open-source, self-hostable alternatives to 1Password that do this?

71a54xd 3y ago
I'm also still waiting for the answer to this question. No way I'm going to let apple or google control half of my access to everything I use online...
- sambazi 3y ago
  with google and apple constituting the smartphone duopoly i'd say this is already the case
  - 71a54xd 3y ago
    Yet I can use one of I don't know... 20 different auth providers or a DB that has nothing tied to these companies...
- CharlesW 3y ago
  FWIW, passkey support doesn't mean that Apple or Google controls anything. It's all standards-based. Use a Yubikey or whatever you like. https://www.yubico.com/resources/glossary/what-is-a-passkey/ https://www.yubico.com/resources/glossary/what-is-a-passkey/
samcat116 3y ago
I think it’s on Bitwarden’s roadmap to be implemented soon
- gurchik 3y ago
  Supposedly sometime in October.
DavideNL 3y ago
Fyi it’s in the works for KeepassXC: https://github.com/keepassxreboot/keepassxc/issues/1870#issuecomment-1322275148 https://github.com/keepassxreboot/keepassxc/issues/1870#issu...

yomlica8 3y ago

> I personally feel safer that passkeys aren't sync'd across multiple vendors' products. Last time I checked into these hardware attestation was part of the specification but the ability export them from a vendors platforms is not. In practice that will mean unapproved platforms can be shut out and walled gardens strengthened. Which will happen sooner or later because it can. Apple supposedly zeroes their attestation but that is only a partial mitigation and relies upon the values of a giant corporation not changing its mind for any host of business reasons. And it does nothing to stop other platforms.

kstrauser 3y ago
I don't know that I've encountered a service that allows exactly one passkey. Everything I've tried either doesn't support passkeys at all, or supports multiple. In the latter case, add an iOS/Android passkey and something separate like a YubiKey. If one gets lost or you stop using it, the other still works.
aseipp 3y ago
FIDO itself specifies that attestation can be used but it's extremely likely browsers aren't going to ever support it for the same reason Apple has publicly said they won't: because attestation is a misfeature for Passkeys, because it completely eliminates the (very important and large) ability to synchronize Passkeys across devices using third party apps or built in browser mechanisms. Having to manually re-enroll every device is like a step backwards 10 years into the past from a usability POV. Device-attestation for passkeys was always 100% DOA for this reason, because without it, they can't form a suitable password replacement in the existing ecosystem, where synchronization is basically expected.
- yomlica8 3y ago
  Bizarre they would make room in the specification for a DOA misfeature no one is going to use and everyone hates. Why not remove it from the spec and place the requirement of synchronization support into the spec instead?
  - 3y ago

recursive 3y ago

> Maybe you misunderstand how they work? For me, it's precisely because I know I don't understand how they work. With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. The test for me is whether I can copy some piece of data out of the password manager and use it to authenticate. If authentication has to "go through" the manager, then my access to my account is vulnerable to the whims of the password manager. Or perhaps the whims of the new corporate owners of the password manager. I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. I'll be holding out either until I can understand satisfactory answers to these, or until support for passwords gets dropped from services I use.

phildenhoff 3y ago
From looking at the 1Password app, exporting Passkeys isn't an option. that's a bit of a usability nightmare IMO, one which I hadn't considered. I'm still strongly in favor of passkeys overall, though. They don't need to be used for every service, but strong, safe, phish-proof asymmetric crypto being used for user auth just makes sense.
WA 3y ago
Good points, maybe 1Password will pull a Unity post-IPO and demand 1 cent per login. Right now, 1Password is really good, but who knows if it'll stay the same.
CharlesW 3y ago
> With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. Fair enough! It still seems a bit like magic when it works. > With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. I'm not sure how a pass[word|key] manager would lock you out of your accounts, but if you don't use password managers for that reason, that same theoretical danger would be true of passkey managers. I don't personally have any of my extremely secure auto-created passwords memorized either, so for me a passkey is not different in that respect. If I inadvertently delete a pass[word|key], I'll have to go through the "forgot my password" process. Within 5 years, I can imagine services without password support. I'd expect that in "lost passkey" cases, those services will support allowing you to log in with a one-time code sent to your registered email address (or SMS) and/or with backup codes. > I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. Here's a real-world example: I played with Apple's passkey support before 1Password's passkey support was available. When 1Password added passkey support, I added another passkey to the sites that supported it and called it "1Password". And here's what it looks like when your Google account has 3 passkeys: https://imgur.com/a/NQl8XPI https://imgur.com/a/NQl8XPI