3 ms·
> I'll just start storing passkeys in my password manager instead of passwords wherever possible Depends on how the password manager stores the passkeys. I no
by jopsen 3y ago
> I'll just start storing passkeys in my password manager instead of passwords wherever possible
Depends on how the password manager stores the passkeys.
I noticed that bitwarden stores TOTP keys such that the secret is exportable. Which means that if you're bitwarden wallet is compromised, even temporarily, the TOTP keys can be stolen.
If the password manager just stores the private key as an encrypted file, then it would probably be better to use a yubikey, iOS or Android device as those are designed to prevent the key from being extractable.
But maybe password managers will store passkeys a HSM.
- Ajedi32 3y agoI don't plan on using an HSM to store my passkeys anytime soon. The security benefits are marginal for me compared to the huge inconvenience of having to manually update my credentials on hundreds of sites every time I buy a new HSM. I'll continue to use WebAuthn hardware keys as a second factor for the small minority of sites where that makes sense. For the rest I'll just use passkeys synced to my password manager.
- dwaite 3y agoYou have a (constantly expanding) choice in what software or hardware your passkeys are provided by, and can decide based on your own risk/convenience trade-offs.