7 ms·

My passkeys are kept in my password manager. Many support them now: 1Password, Keeper, Dashlane, BitWarden, and I know KeePassX is working on support. Sure it'

by syhol 3y ago

My passkeys are kept in my password manager. Many support them now: 1Password, Keeper, Dashlane, BitWarden, and I know KeePassX is working on support. Sure it's not as secure as a hardware token but it's a nice sweet spot between convenience and security. However I wish more platforms let me use TOTP and passkeys together for MFA. That way I don't need to put all my trust in a single password manager company. 2FAS with it's browser plugin gives a really slick experience and it backups to Google/Apple storage with a separate password to encrypt your OTP secret keys.

varjolintu 3y ago
I'm sure you mean KeePassXC? KeePassX has been dead for years.
- syhol 3y ago
  Yes, my bad.
- SloopJon 3y ago
  KeePassXC added support for passkeys in 2.7.7, released a week ago: https://keepassxc.org/blog/2024-03-10-2.7.7-released/ https://keepassxc.org/blog/2024-03-10-2.7.7-released/ This post prompted me to give it a try at webauthn.io. Passkey support is disabled by default, so you have to enable it in the settings for the browser extension. After that, the UI seems reasonable enough. It creates an entry with a "Passkey" tag, where the Password field is empty, and the credentials are stored as additional attributes on the Advanced tab. One thing I'm not sure about: although the extension has a setting to fall back to the browser's own passkey support, when I dismissed the KeePassXC prompt, I did not get a prompt from Firefox.
  - varjolintu 3y ago
    The fallback should be fixed in extension version 1.9.0.2.
  - ric2b 3y ago
    > Passkey support is disabled by default Thank, I hadn't noticed that, I thought I had to wait for the extension to be updated after the announcement from KeepassXC. > After that, the UI seems reasonable enough. I tried it on webauthn.io and I'm wondering if there's a point in showing a prompt on every login attempt, if passkeys are phishing proof. Why not just allow the login right away? Maybe show a notification that it happened, but why wait for user confirmation?
jacooper 3y ago
Bitwarden still doesn't support it on mobile, where it would probably the most useful, partially because Bitwardens auto fill on android is extremely unreliable, especially when dealing with two login pages (email then password).
- jeroenhd 3y ago
  Bitwarden doesn't have support in apps, but you can get passkey support in Firefox by installing the Bitwarden addon. I would've preferred more integration here (because unlocking the app vault doesn't unlock the addon vault, for example) but I think this is just because of the lack of proper APIs for this kind of thing. Android's auto fill API is using the standard system API, but the system API clearly isn't designed for the "enter your username, hit next, then enter your password" flow.
Handprint4469 3y ago
KeePassXC supports them in their latest stable version as of last week [0]. [0]: https://keepassxc.org/blog/2024-03-10-2.7.7-released/ https://keepassxc.org/blog/2024-03-10-2.7.7-released/

by syhol 3y ago

varjolintu 3y ago

I'm sure you mean KeePassXC? KeePassX has been dead for years.

syhol 3y ago
Yes, my bad.
SloopJon 3y ago
KeePassXC added support for passkeys in 2.7.7, released a week ago: https://keepassxc.org/blog/2024-03-10-2.7.7-released/ https://keepassxc.org/blog/2024-03-10-2.7.7-released/ This post prompted me to give it a try at webauthn.io. Passkey support is disabled by default, so you have to enable it in the settings for the browser extension. After that, the UI seems reasonable enough. It creates an entry with a "Passkey" tag, where the Password field is empty, and the credentials are stored as additional attributes on the Advanced tab. One thing I'm not sure about: although the extension has a setting to fall back to the browser's own passkey support, when I dismissed the KeePassXC prompt, I did not get a prompt from Firefox.
- varjolintu 3y ago
  The fallback should be fixed in extension version 1.9.0.2.
- ric2b 3y ago
  > Passkey support is disabled by default Thank, I hadn't noticed that, I thought I had to wait for the extension to be updated after the announcement from KeepassXC. > After that, the UI seems reasonable enough. I tried it on webauthn.io and I'm wondering if there's a point in showing a prompt on every login attempt, if passkeys are phishing proof. Why not just allow the login right away? Maybe show a notification that it happened, but why wait for user confirmation?

jacooper 3y ago

Bitwarden still doesn't support it on mobile, where it would probably the most useful, partially because Bitwardens auto fill on android is extremely unreliable, especially when dealing with two login pages (email then password).

jeroenhd 3y ago
Bitwarden doesn't have support in apps, but you can get passkey support in Firefox by installing the Bitwarden addon. I would've preferred more integration here (because unlocking the app vault doesn't unlock the addon vault, for example) but I think this is just because of the lack of proper APIs for this kind of thing. Android's auto fill API is using the standard system API, but the system API clearly isn't designed for the "enter your username, hit next, then enter your password" flow.

Handprint4469 3y ago

KeePassXC supports them in their latest stable version as of last week [0]. [0]: https://keepassxc.org/blog/2024-03-10-2.7.7-released/ https://keepassxc.org/blog/2024-03-10-2.7.7-released/