5 ms·
You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/
by sholladay 2y ago
You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code.
Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using.
For someone who requires being able to sign in to, say, GitHub from multiple different operating systems or platforms, you have a few options.
1. Use a passkey on your primary device, say an iPhone. You can still sign in to GitHub on a Windows computer or Android phone but you must have your iPhone with you. During sign in, there is an option to show a QR code on the Windows/Android, which you will point your iPhone at, and the two devices will do a secure handshake to sign you in. This is probably the worst option from a UX standpoint if you sign in on lots of devices that are not your primary.
2. Use a physical security key to store a FIDO2 key instead of a passkey. These devices are inherently cross-platform. Remember, a passkey is just a type of FIDO2 key. No one is forcing you to store it in the cloud. You can buy something like the YubiKey 5C NFC to store your keys completely offline and under your own control. The tradeoff is you will need to have it with you and you will need to plug it in every time you create an account or sign in.
3. Add multiple passkeys to your GitHub account, one for each platform you want to be able to sign in on. Unlike passwords, where an account generally only has one password at a time, it’s normal and even recommended to have at least one backup FIDO2/passkey registered with an account.
And of course these aren’t mutually exclusive, you can mix and match these techniques, perhaps depending on how important the account is or how/where you typically access it. Maybe you only use a single passkey on your primary device for your bedtime social media scrolling, but use a passkey with a backup FIDO2 security key on GitHub.
- Wowfunhappy 2y agoBut what happens if I as an iPhone user want to switch to Android next year? Can I move my Apple passkeys?
- signal11 2y agoYou can use passkeys cross platform already, eg with 1Password or even KeePass XC. But I do agree with the point that Passkeys make it really easy to get locked in unless you’re careful.
- Wowfunhappy 2y ago> You can use passkeys cross platform already, eg with 1Password or even KeePass XC. But then I have the analogous problem of never being able to switch password managers!
- nxicvyvy 2y agoBitwarden exports passkeys along with everything else.
- deleted 2y ago[deleted]
- epistasis 2y agoCan anything else import a passkey? It makes me nervous to have export, Id rather just have multiple platforms.
- nxicvyvy 2y agoAnother bitwarden server? You can self host. The idea isn't to move your keys around willy nilly the idea is that should you need to, you're not beholden to bitwarden inc.
- vbezhenar 2y agoNo, you can't. You need to login into every website and replace passkey with new one in website-specific way.
- snowwrestler 2y agoNo, you add a new passkey from Android and then remove the passkey from iPhone. 1. Login with the passkey from your iPhone. 2. In your account, add a new passkey from your new Android. Now both passkeys are active. 3. Login with your new Android passkey. 4. In your account, deactivate the passkey that is stored on your iPhone. Passkeys aren’t passwords. You can have more than one active at the same time. So instead of moving a single passkey around, you add or remove them to change devices or service providers.
- hedora 2y agoI have 400 accounts in my password manager. There’s no way I’m doing that for each of them (or figuring out which ones support passkeys).
- akie 2y agoThen don’t change phone OS, or put your passkeys in a third party password manager.
- apple4ever 2y agoOr... use passwords and 2FA which we have been using forever and for years respectively.
- lupire 2y agoWhy is that better? It's the same thing as a passkey managwer, but twice the work.
- deleted 2y ago[deleted]
- lupire 2y ago"We do not support competitors' products."
- vbezhenar 2y agoMy issue with option 1 is that it utilizes bluetooth. And everything involving bluetooth is not reliable.
- tsimionescu 2y agoThis all sounds like "it's technically possible, but it's a huge huge hassle and sticking with passwords is significantly easier".
- apple4ever 2y agoSeems like it. And the primary reason I haven't switched. Seems like a huge hassle and offers no advantages to me.
- ratg13 2y agoI consider myself technically savvy, but I end up with countless different passkeys for different devices, and then multiplied again by all of the different services out there. I have so many keys scattered everywhere that I would need an excel sheet to keep track of them. I regret not doing that already .. or perhaps I regret using passkeys at all. I am still trying to figure that out.
- calaverainfo 2y agoNumber 2 is not true. I have a Yubikey and it can't be used on Android without a Google made app or account. It's always the same story, give a plausible option to seem open or neutral, but make sure there are "details" that establishes chain of consequences preventing it that is weird enough to allow denying intention. Even though I'm not that young I thought I just need to wait for Firefox to implement it, but as time went by I got curious and found out why it actually can't be done.
- matheusmoreira 2y agoWow. I just bought a couple of new YubiKeys for the OpenPGP Curve25519 support. I was looking forward to using the NFC feature with my Android phone. Is it just a Chrome problem? I downloaded some OpenPGP app from fdroid and it says it supports NFC keys.
- calaverainfo 2y agoI'm not sure about your exact situation, lot of the scenarios are OK, just the one without Google services which are dependent on Google account doesn't work. That is actually irrelevant for "normal" phone users that are logged to Google all the time anyway.
- matheusmoreira 2y agoI was hoping to be able to use the new YubiKey to sign code from inside Termux.
- sholladay 2y agoI was able to log in to GitHub using a Yubikey on my Pixel without a special app. Check whether your Yubikey supports resident keys (aka discoverable credentials) and whether the FIDO key for your account was created with residentKey: true, otherwise it’s a completely different (older) flow under the hood, where the private key actually gets sent to the server, and it wouldn’t surprise me if that’s the underlying cause of what’s happening to you.
- beams_of_light 2y ago"Alright Mom, here's what you have to do..."
- deleted 2y ago[deleted]