4 ms·

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1

1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.

numpad0 3y ago
Can't you enroll a Yubikey and keep it in a safe?
maxwellg 3y ago
1Password's Passkey support feels very aggressively growth-hacky to me. They intercept calls to `window.credentials` and if you want to use 1Password along side other verifiers like Yubikey, you need to go into your settings and disable their passkeys offering entirely. It's similar to how they also intercept (and globally disable!) Google One Tap prompts in order to show their own OAuth prompt. I only use their Chrome extension so I'm not sure if the native app experience is significantly different.
- LeoPanthera 3y ago
  I'm kind of mad at 1Password - but this isn't correct. When the 1Password prompt some up, you can click the little "USB key" icon which ostensibly is for hardware keys, but all it does is pass control back to the OS, at which point your iCloud prompt, or whatever provider you are using, can be used.
  - maxwellg 3y ago
    Ah, good to know. I immediately turned off the monkeypatching and didn't spend too much time playing around with it.
shepherdjerred 3y ago
It's a feature that came out just last month. Give them some time.
rkagerer 3y ago
Do any of the third-party, self-hosted password managers provide a compatible passkey implementation that can actually be exported and backed up in a secure manner?
idle_zealot 3y ago
Isn't that the point of Passkeys? The user isn't allowed to interface with them directly, so social engineering can't compromise them [1]. Rather than move your passkey between devices, you're meant to generate a different passkey for each device, then register all of them with the relevant service, like SSH keys. 1: of course, a user could still be tricked into adding an attacker's passkey to their account or something
- LeoPanthera 3y ago
  But 1Password syncs your passkey to all your devices, so you only have one.
  - efitz 3y ago
    Don't worry, if you lose your passkey all you need is access to your email to receive a password reset link. </sarcasm>
    - CharlesW 3y ago
      That's literally the solution to "What if I lose all the passkeys associated with my account and I've also forgotten my password?"
      - deleted 3y ago
        [deleted]
      - afiori 3y ago
        Except for when it happens to your email account.
      - drdaeman 3y ago
        The major problem with passkeys is that first they were poorly designed so there's no portability or ability to enroll an offline (or worse, physically unavailable, like stored in a safe) authenticator, then there's this kludge to work around the limitation. It was obvious from day 0 (to anyone except for Apple and Microsoft) that people do have multiple devices and not all of them are from a single vendor. My only explanation is that they deliberately decided to ignore this aspect, because it wasn't in corporate interests. They made it significantly easier to lose all the passkeys, because they made it very hard to add multiple passkeys (you literally have to walk/run/drive/fly and grab every different device you have, get it online and register - or get properly locked in with a single vendor and pray they work for you, forever). Carrying a Yubikey does not work (you can lose it). iCloud/Windows Hello does not work (you can be on a non-Apple/Microsoft device). 1Password is better but still does not really work (you can lose access to your account). They're all SPOFs, and avoiding SPOF was deliberately made hard (you can't easily enroll a "backup" Yubikey that you don't have at hand, and if you have it at hand it's not a backup anymore). Heck, "official" demo at passkeys.io doesn't even bother to showcase how multiple passkeys are going to be a thing at all, which is an obvious red flag. That is, not to mention that a growing number of vendors contributed to the crappiness by limiting what kind of authenticators and which platforms one can use (BestBuy, PayPal and so on), contributing to decreased security and increased headaches.
Yeul 3y ago
I had a discussion with my mother advising her to switch: she is afraid of changing ISP because her email is tied to her provider. We fixed this on mobile years ago but email is still a goddamn mess. Moral of the story: never get locked in.
- CharlesW 3y ago
  You're not locked in. Want to switch? Add a passkey. Lose all your passkeys? Do the "forgot password" thing just like you've done forever.
  - kibwen 3y ago
    The "forgot password" flow involves accessing your email. And accessing your email without having access to your passkey requires a device that has previously logged in to your email. And the device that has previously logged in to your email is the same device where your passkeys are stored, which is to say, the same device that is now lost or bricked, which is the reason your passkeys are lost in the first place. And sure, you and I have multiple devices. We're in the minority. Most people just have the one. Without another way in, they're irrevocably fucked.
    - sbuk 3y ago
      You only use your passkey when logging in to your email account if you use a web-based client exclusivley.
droopyEyelids 3y ago
This is a quibble, but if 1password goes down, your vaults still exist on all your devices and the app will keep working, it's only the syncing of modifications between devices that won't work.
gumby 3y ago
Is version 8 reasonably mac-like? On 7 it's still a mac application that acts like a true mac application (drag/drop works properly everywhere, expansion, properly keyboard-enabled, etc) which is well nigh impossible when running inside a chrome box. Agile Bits support kept insisting it was the same as the old native app and people kept complaining about bugs until I stopped following it.
- LeoPanthera 3y ago
  It's as Mac-like as any other Electron app. Which is to say, it does a pretty good impression of a Mac app, but the bundle is 345M, with another 244M hiding in your Library directory.
- tomduncalf 3y ago
  It’s so rare that I use anything other than the 1Password Chrome extension that I couldn’t really tell you! The main app seems.. fine? But like I say, I hardly use it, so I probably wouldn’t notice details like you mention. Do you have a different workflow where you use the main app a lot?
  - gumby 3y ago
    I keep a lot (including images) in the main app as an ecrypted shared resource for IDs and various other secure info. If I suddenly need my insurance card I can quickly grab it out of the app rather than rummage through the (unencrypted) icloud or dropbox filesystem on ios. And I can cut/past text out of the images. I also use it for logging into apps, dragging credentials into remote machines over ssh etc. With 1password 7 whe safari plug in is more conveniently integrated than the chrome one which is pretty clunkly by comparison, though this is true of other chrome plug ins too. But that's not a big deal as I rarely use chrome anyway, just for google docs which don't need 1password.
    - tomduncalf 3y ago
      Interesting! I had no idea you could even store files in it!
jxcl 3y ago
Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys. See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_reddit_were_the_team_behind_passkeys_in/k3g1kz5/ https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd... Re. your point about 1Password going down: Your passwords and passkeys are all stored locally when they sync to your devices. If 1Password becomes unreachable for any reason, you still have access to everything in your vaults, you just can't sync between devices any more.
- varjolintu 3y ago
  If you consider KeePassXC to be one of the big players, they (will) support importing and exporting Passkeys.
  - DavideNL 3y ago
    ...and if i understand correctly, websites can dictate whether they allow KeePassXC (or any other specific vendor) to store their passkey. In other words, if a website doesn't like that their passkeys can be exported, they can block KeePassXC.
- DavideNL 3y ago
  > "If 1Password becomes unreachable for any reason, you still have access to everything in your vaults" Temporarily, i guess? Since it's not stored in an open format? Is this not bound to some sort of "Secure Enclave" or whatever, and won't survive a reinstall / restore / etc. ?
- XorNot 3y ago
  And what a surprise that is, the one feature necessary to ensure vendor lock in doesn't happen was at 0 priority before they rolled it out.
  - SheinhardtWigCo 3y ago

numpad0 3y ago

Can't you enroll a Yubikey and keep it in a safe?

maxwellg 3y ago

1Password's Passkey support feels very aggressively growth-hacky to me. They intercept calls to `window.credentials` and if you want to use 1Password along side other verifiers like Yubikey, you need to go into your settings and disable their passkeys offering entirely. It's similar to how they also intercept (and globally disable!) Google One Tap prompts in order to show their own OAuth prompt. I only use their Chrome extension so I'm not sure if the native app experience is significantly different.

LeoPanthera 3y ago
I'm kind of mad at 1Password - but this isn't correct. When the 1Password prompt some up, you can click the little "USB key" icon which ostensibly is for hardware keys, but all it does is pass control back to the OS, at which point your iCloud prompt, or whatever provider you are using, can be used.
- maxwellg 3y ago
  Ah, good to know. I immediately turned off the monkeypatching and didn't spend too much time playing around with it.

shepherdjerred 3y ago

It's a feature that came out just last month. Give them some time.

rkagerer 3y ago

Do any of the third-party, self-hosted password managers provide a compatible passkey implementation that can actually be exported and backed up in a secure manner?

idle_zealot 3y ago

Isn't that the point of Passkeys? The user isn't allowed to interface with them directly, so social engineering can't compromise them [1]. Rather than move your passkey between devices, you're meant to generate a different passkey for each device, then register all of them with the relevant service, like SSH keys. 1: of course, a user could still be tricked into adding an attacker's passkey to their account or something

LeoPanthera 3y ago
But 1Password syncs your passkey to all your devices, so you only have one.
- efitz 3y ago
  Don't worry, if you lose your passkey all you need is access to your email to receive a password reset link. </sarcasm>
  - CharlesW 3y ago
    That's literally the solution to "What if I lose all the passkeys associated with my account and I've also forgotten my password?"
    - deleted 3y ago
      [deleted]
    - afiori 3y ago
      Except for when it happens to your email account.
    - drdaeman 3y ago
      The major problem with passkeys is that first they were poorly designed so there's no portability or ability to enroll an offline (or worse, physically unavailable, like stored in a safe) authenticator, then there's this kludge to work around the limitation. It was obvious from day 0 (to anyone except for Apple and Microsoft) that people do have multiple devices and not all of them are from a single vendor. My only explanation is that they deliberately decided to ignore this aspect, because it wasn't in corporate interests. They made it significantly easier to lose all the passkeys, because they made it very hard to add multiple passkeys (you literally have to walk/run/drive/fly and grab every different device you have, get it online and register - or get properly locked in with a single vendor and pray they work for you, forever). Carrying a Yubikey does not work (you can lose it). iCloud/Windows Hello does not work (you can be on a non-Apple/Microsoft device). 1Password is better but still does not really work (you can lose access to your account). They're all SPOFs, and avoiding SPOF was deliberately made hard (you can't easily enroll a "backup" Yubikey that you don't have at hand, and if you have it at hand it's not a backup anymore). Heck, "official" demo at passkeys.io doesn't even bother to showcase how multiple passkeys are going to be a thing at all, which is an obvious red flag. That is, not to mention that a growing number of vendors contributed to the crappiness by limiting what kind of authenticators and which platforms one can use (BestBuy, PayPal and so on), contributing to decreased security and increased headaches.

Yeul 3y ago

I had a discussion with my mother advising her to switch: she is afraid of changing ISP because her email is tied to her provider. We fixed this on mobile years ago but email is still a goddamn mess. Moral of the story: never get locked in.

CharlesW 3y ago
You're not locked in. Want to switch? Add a passkey. Lose all your passkeys? Do the "forgot password" thing just like you've done forever.
- kibwen 3y ago
  The "forgot password" flow involves accessing your email. And accessing your email without having access to your passkey requires a device that has previously logged in to your email. And the device that has previously logged in to your email is the same device where your passkeys are stored, which is to say, the same device that is now lost or bricked, which is the reason your passkeys are lost in the first place. And sure, you and I have multiple devices. We're in the minority. Most people just have the one. Without another way in, they're irrevocably fucked.
  - sbuk 3y ago
    You only use your passkey when logging in to your email account if you use a web-based client exclusivley.

droopyEyelids 3y ago

This is a quibble, but if 1password goes down, your vaults still exist on all your devices and the app will keep working, it's only the syncing of modifications between devices that won't work.

gumby 3y ago

Is version 8 reasonably mac-like? On 7 it's still a mac application that acts like a true mac application (drag/drop works properly everywhere, expansion, properly keyboard-enabled, etc) which is well nigh impossible when running inside a chrome box. Agile Bits support kept insisting it was the same as the old native app and people kept complaining about bugs until I stopped following it.

LeoPanthera 3y ago
It's as Mac-like as any other Electron app. Which is to say, it does a pretty good impression of a Mac app, but the bundle is 345M, with another 244M hiding in your Library directory.
tomduncalf 3y ago
It’s so rare that I use anything other than the 1Password Chrome extension that I couldn’t really tell you! The main app seems.. fine? But like I say, I hardly use it, so I probably wouldn’t notice details like you mention. Do you have a different workflow where you use the main app a lot?
- gumby 3y ago
  I keep a lot (including images) in the main app as an ecrypted shared resource for IDs and various other secure info. If I suddenly need my insurance card I can quickly grab it out of the app rather than rummage through the (unencrypted) icloud or dropbox filesystem on ios. And I can cut/past text out of the images. I also use it for logging into apps, dragging credentials into remote machines over ssh etc. With 1password 7 whe safari plug in is more conveniently integrated than the chrome one which is pretty clunkly by comparison, though this is true of other chrome plug ins too. But that's not a big deal as I rarely use chrome anyway, just for google docs which don't need 1password.
  - tomduncalf 3y ago
    Interesting! I had no idea you could even store files in it!

jxcl 3y ago

Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys. See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_reddit_were_the_team_behind_passkeys_in/k3g1kz5/ https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd... Re. your point about 1Password going down: Your passwords and passkeys are all stored locally when they sync to your devices. If 1Password becomes unreachable for any reason, you still have access to everything in your vaults, you just can't sync between devices any more.

varjolintu 3y ago
If you consider KeePassXC to be one of the big players, they (will) support importing and exporting Passkeys.
- DavideNL 3y ago
  ...and if i understand correctly, websites can dictate whether they allow KeePassXC (or any other specific vendor) to store their passkey. In other words, if a website doesn't like that their passkeys can be exported, they can block KeePassXC.
DavideNL 3y ago
> "If 1Password becomes unreachable for any reason, you still have access to everything in your vaults" Temporarily, i guess? Since it's not stored in an open format? Is this not bound to some sort of "Secure Enclave" or whatever, and won't survive a reinstall / restore / etc. ?
XorNot 3y ago
And what a surprise that is, the one feature necessary to ensure vendor lock in doesn't happen was at 0 priority before they rolled it out.
- SheinhardtWigCo 3y ago