4 ms·
I am unfamiliar with passkeys. Can they be exported and imported, or WILL it be possible one day? Because that affects my choice to adopt them today.
by sph 3y ago
I am unfamiliar with passkeys. Can they be exported and imported, or WILL it be possible one day?
Because that affects my choice to adopt them today.
- vbezhenar 3y agoNative implementations do not allow exporting and importing. Of course technically it’s possible but they gone great lengths hiding it from user “for security”, so probably they wouldn’t allow any export. If you run vault warden, it worked for me at passkeys.io and it’s just an SQL DB, so surely you could extract anything (although I didn’t see a specific UI for it).
- Timshel 3y agoI have not tested it but some users in the bitwarden forum has mentionned that it's included in the vault export (cf https://community.bitwarden.com/t/passkey-portability/59177/16 https://community.bitwarden.com/t/passkey-portability/59177/...).
- toomuchtodo 3y agoIndividual choices to not adopt due to this requirement is unlikely to impact mass market adoption. While I certainly hope the export capability is delivered as promised, it won’t hold most folks back from adopting this auth mechanism. https://www.engadget.com/google-says-its-secure-entry-passkeys-have-been-used-a-billion-times-120001230.html https://www.engadget.com/google-says-its-secure-entry-passke... (“Google says its secure entry passkeys have been used a billion times by 400 million Google accounts”)
- tjoff 3y agoSo the average user has only used passkeys 2.5 times? Yikes.
- 1oooqooq 3y agoand i bet it went like: 1. login on computer. click next mindlessly on setup flow. 2. use account 3. try to login on phone. click next mindlessly on setup flow again. 4. where's my data?! oh well, lost my old account. let's use the new one 5. eternal confusion while switching devices. never return to site again. = 2.5 times per user
- toomuchtodo 3y agoHow often do you login to your Google account once logged in? I don't remember the last time Google asked me to login, because the session persists.
- tjoff 3y agoI hope that you properly segment your browsing then, because surely you don't browse the web while logged in to google?
- toomuchtodo 3y agoMoving the goalposts to a data security and privacy concern from strong auth factors. I don’t care if Google has my browsing history. I do care if someone else can log into my account, or ease of managing my own credentials. Auth protects you from others, data security and privacy measures protect you from the counterparty.
- tjoff 3y agoNot moving the goalposts. Just stating why you'd want to login often, or solve it in some other way.
- p0seidon 3y agohttps://github.blog/2024-04-24-securing-millions-of-developers-through-2fa/ https://github.blog/2024-04-24-securing-millions-of-develope... ("Finally, as a result of our improved enrollment experience and passkey rollout, our data shows that it’s 47% more likely users will configure two or more forms of 2FA.") that is also promising so it is not just Google, where somebody could argue they promote it for other reasons.
- 1oooqooq 3y ago> https://www.engadget.com/google-says-its-secure-entry-passkeys-have-been-used-a-billion-times-120001230.html https://www.engadget.com/google-says-its-secure-entry-passke... lol. engadget literally copied and pasted the press release they gov via email! it still have all the links hidden by their corporate phishing thing: like: https://urldefense.com/v3/__http://g.co/passkeys__;!!Op6eflyXZCqGR5I!GFYwYEDk1Zq0xZpr4q834hOMHa1R4ovVB7D37okCF9TxEVdc5cuJkzdaExbdZ1BvCPR5xkjYtLaF_0Ldk8v53R8$