4 ms·

Well, currently, you can export your passwords between your new password managers. You may be able to do that with passkeys. Also, passwords don't have rejecti

• CharlesW 3y ago
  Fair enough — I've never done a bulk dump of my usernames/passwords, but I can understand how that's a problem for who do (until there's a common passkey interchange format, at least). One aspect of passkeys that may offset the impact of this is the ability to have multiple passkeys for an account, which isn't possible with passwords. > Also, passwords don't have rejecting [optionally, for now] non FIDO certified devices as a part of the spec. You'll have to use a Trusted(tm) passkey manager. Sorry, I may not be parsing this correctly: Are you saying that security requirements for pass[word|key] managers is bad? Or are you saying that they're bad because it means open-source solutions can't support passkeys, as @Ridj48dhsnsh suggests?
  • aftbit 3y ago
    AIUI the concern is that you will only be able to use Passkeys that are held on devices that have been blessed. You will never get your custom solution blessed, so your access to your bank and government services will become dependent on being in good standing with Google. If your Google account gets deleted or your phone gets remotely deprovisioned, you will be unable to authenticate, and any attempt to create a "backup" against this situation that is fully under your control will be blocked by the attestation requirements.