4 ms·

You can store passkeys in a password manager as well: https://1password.com/product/passkeys https://1password.com/product/passkeys The super simple explanati

You can store passkeys in a password manager as well: https://1password.com/product/passkeys https://1password.com/product/passkeys The super simple explanation is: SSH keys for websites. You have a unique private key for each website account stored on your device, in a local password manager, or in a cloud synced password manager (iCloud account, Google account, 1Password, etc). The website only gets the public key, so unlike password auth your secret is never given to the website. When accessing that website, the website can send a challenge which your browser answers using your private key associated with that specific domain. (I'm not a passkey expert and there are a lot more technical details to this, but this is my 10,000ft mental model of what's going on)

MadVikingGod 2y ago
I currently use the 1Password passkeys, and when they work, it's pretty good. I get all the fun of showing up on a website, and with three clicks, I'm in. But I've used them on just a few websites (email and GitHub), and they work correctly maybe 10% of the time. First, I had to figure out how to get the website to request the passkey. Then I had to figure out that I didn't want to use the browser's passkey but 1Password's, which is different on different browsers and platforms. And good luck if I'm on mobile, I don't think it's ever worked. At this point I'm taking a break from signing up new passkeys. I'll stick to UN+PW+(TOTP|Yubikeys). PS: Why is it that no financial institution lets you use anything more than a SMS U2F?
rcarmo 2y ago
It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers frequently). For anyone with more than one platform or one device in their lives they suddenly become added complexity, because even though you _can_ have more than one passkey per account per service, in practice there are all sorts of weird edge cases. They're just not mature yet, period.
- vel0city 2y ago
  You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on my desktop which are different from the passkeys on my phone which are different from the passkeys on my main yubikey which are different from the passkeys on my backup yubikey. Edited due to acknowledging people may choose a variety of alternative workflows.
  - abadpoli 2y ago
    Great in theory, but in practice there are still a frustrating amount of websites and services that put a low upper limit (usually just one or two) of the number of keys you can enroll. This effectively makes it impossible to do what you’re saying. It sucks.
    - vel0city 2y ago
      I hear this a lot but it hasn't generally been my experience. The only site I've personally come across that supports webauthn/passkeys but doesn't support multiple is the AWS management page. Which I essentially bypass by just configuring SSO and using an IdP which does support it. Every other site I've come across that supports these things supports multiple. What common sites support only one or two?
      - cuu508 2y ago
        AWS now supports multiple MFA devices per account.
        vel0city 2y ago
        That's awesome to hear, thanks for sharing!
nindalf 2y ago
How do the private keys get synced across my devices? What's the default in the Apple, Google and Microsoft ecosystems? Devices get lost after all.
- stetrain 2y ago
  By default they go in your cloud synced password manager for those platforms. iCloud Keychain etc. Or you can use a third party password manager like 1Password or KeePassXC.
mixmastamyk 2y ago
How do you back up the private key? With ssh I know to back up .ssh with the rest of my home folder. With a passkey I'd have no idea where it was, and get the feeling the "modern" software won't tell me on purpose, so that it can manage/sync it for me. Which leads to a lack of a mental model.
- stetrain 2y ago
  The same way you would back up passwords stored in iCloud Keychain, 1Password, KeePassXC, etc.
  - mixmastamyk 2y ago
    So you don’t, just leave it to BigTech, thanks.
    - joshuaissac 2y ago
      KeePassXC is not Big Tech. It is open source and self-hosted. It supports exporting the private keys, although Big Tech is not happy about that feature: https://news.ycombinator.com/item?id=40167782 https://news.ycombinator.com/item?id=40167782
      - mixmastamyk 2y ago
        Interesting rabbit hole. Seems like it supports my point about the powers that be working to eliminate the possibility.

MadVikingGod 2y ago

I currently use the 1Password passkeys, and when they work, it's pretty good. I get all the fun of showing up on a website, and with three clicks, I'm in. But I've used them on just a few websites (email and GitHub), and they work correctly maybe 10% of the time. First, I had to figure out how to get the website to request the passkey. Then I had to figure out that I didn't want to use the browser's passkey but 1Password's, which is different on different browsers and platforms. And good luck if I'm on mobile, I don't think it's ever worked. At this point I'm taking a break from signing up new passkeys. I'll stick to UN+PW+(TOTP|Yubikeys). PS: Why is it that no financial institution lets you use anything more than a SMS U2F?

rcarmo 2y ago

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers frequently). For anyone with more than one platform or one device in their lives they suddenly become added complexity, because even though you _can_ have more than one passkey per account per service, in practice there are all sorts of weird edge cases. They're just not mature yet, period.

vel0city 2y ago
You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on my desktop which are different from the passkeys on my phone which are different from the passkeys on my main yubikey which are different from the passkeys on my backup yubikey. Edited due to acknowledging people may choose a variety of alternative workflows.
- abadpoli 2y ago
  Great in theory, but in practice there are still a frustrating amount of websites and services that put a low upper limit (usually just one or two) of the number of keys you can enroll. This effectively makes it impossible to do what you’re saying. It sucks.
  - vel0city 2y ago
    I hear this a lot but it hasn't generally been my experience. The only site I've personally come across that supports webauthn/passkeys but doesn't support multiple is the AWS management page. Which I essentially bypass by just configuring SSO and using an IdP which does support it. Every other site I've come across that supports these things supports multiple. What common sites support only one or two?
    - cuu508 2y ago
      AWS now supports multiple MFA devices per account.
      - vel0city 2y ago
        That's awesome to hear, thanks for sharing!

nindalf 2y ago

How do the private keys get synced across my devices? What's the default in the Apple, Google and Microsoft ecosystems? Devices get lost after all.

stetrain 2y ago
By default they go in your cloud synced password manager for those platforms. iCloud Keychain etc. Or you can use a third party password manager like 1Password or KeePassXC.

mixmastamyk 2y ago

How do you back up the private key? With ssh I know to back up .ssh with the rest of my home folder. With a passkey I'd have no idea where it was, and get the feeling the "modern" software won't tell me on purpose, so that it can manage/sync it for me. Which leads to a lack of a mental model.

stetrain 2y ago
The same way you would back up passwords stored in iCloud Keychain, 1Password, KeePassXC, etc.
- mixmastamyk 2y ago
  So you don’t, just leave it to BigTech, thanks.
  - joshuaissac 2y ago
    KeePassXC is not Big Tech. It is open source and self-hosted. It supports exporting the private keys, although Big Tech is not happy about that feature: https://news.ycombinator.com/item?id=40167782 https://news.ycombinator.com/item?id=40167782
    - mixmastamyk 2y ago
      Interesting rabbit hole. Seems like it supports my point about the powers that be working to eliminate the possibility.