13 ms·

FIDO Alliance publishes new spec to let users move passkeys across providers

• troupo 2y ago
  I came across an opinion I largely agree with: https://mastodon.social/@lapcatsoftware/113308133338196824 https://mastodon.social/@lapcatsoftware/113308133338196824 and https://mastodon.social/@lapcatsoftware/113308273654667583 https://mastodon.social/@lapcatsoftware/113308273654667583 > These big tech companies will do anything possible to prevent users from ever actually being able to access their own passkeys. > Export and import should have been extremely simple. Instead, they took years to come up with some convoluted system where the only possibility is to transfer from one vendor lock-in to another vendor lock-in. > With passkeys, the big tech companies are executing a coup d'état of authentication, just like they did for HTML itself. > In the end, they control every protocol, become the gatekeepers for the web.
  • NikolaNovak 2y ago
    So it's not just me! I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone. If I show up naked, I can login to the system via password but I am conpletely useless with a pass key. And for somebody like myself who uses multiple devices daily (two phones, two tablets, several laptops and desktops), it seems a nightmare to set them all up or maintain:-( It feels a system designed for those who live by their phone and trust some specific service provider with their life. I'm not in either of those categories :-(. I still don't understand what the "Keepass, "little black notebook", and "good memory" equivalents are.
    • portaouflop 2y ago
      Idk I just set up both - email&password which live in my password manager and then passkeys for convenience - I can just hit a button without thinking and I’m in. It’s probably different for everyone but in case I have strictly separate devices- so a laptop where I have my work accounts and a desktop for games and some personal stuff. I don’t really use anything on a regular basis that needs accounts on my personal devices, but that’s probably very weird nowadays…
      • sph 2y ago
        I already hit a button (the Bitwarden icon in my browser toolbar) so I do not see what passkeys buy me, except a terrible hassle the day I want to change password manager. It is a solution designed to lock people in the Apple/Google walled gardens, and I don't see why everybody is pushing for it.
        • izacus 2y ago
          Passkeys work fine with password managers like 1Password, KeePassXC, Bitwarden and others, why do you keep repeating this walled garden shtick? They're literally a cryptostring stored in your password manager just like your other passwords.
          • troupo 2y ago
            > They're literally a cryptostring stored in your password manager just like your other passwords. So I can copy paste them somewhere or move them around without "Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)"?
            • rcxdude 2y ago
              With Keepass you can, at least. Other ones not so much.
            • izacus 2y ago
              You can copy paste them using those formats. What are you arguing about here actually?
              • FireBeyond 2y ago
                How does one get a passkey from iCloud into one of these formats? "You can't take your passkeys from Apple Passwords" s/iCloud/1Password? "There's not a way to import/export passkeys" s/iCloud/Google? So "you can copy paste them using those formats, if you can get them into those formats in the first place".
    • wolletd 2y ago
      KeepassXC actually supports passkeys and can be a passkey provider in a desktop browser. And Android 14 seems to allow changing the passkey provider in the android system as well. With that, the only thing left would be a KeepassXC-compatible app that can serve as provider on android, using the same database as the desktop. With that setup, I'd be willing to use passkeys exclusively (my phone is still Android 13 and I don't know about app support). I already can't login anywhere (important) without access to my password manager.
      • Dagonfly 2y ago
        Can confirm: Using Android 14 and Bitwarden, I can sign in to github.com using my passkey. It pops up a system dialog where I can select Bitwarden and then my Github username. Last time I checked, the Bitwarden Vault export included the whole FIDO credential including the private key.
        • wolletd 2y ago
          Bitwarden (and Lastpass, iirc) support passkeys a little longer than KeePassXC. I'm glad to hear they achieved full integration. As a keepass database is used by various open source clients from different vendors, it just takes a little longer to get all this done. But I'm sure we'll get there eventually.
      • barkerja 2y ago
        > Android 14 seems to allow changing the passkey provider in the android system as well It's worth noting this is also supported in iOS and macOS. Settings > General > AutoFill & Passwords
    • izacus 2y ago
      > I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone. There seems to be a lot of misunderstanding of passkeys indeed. They're in no way different than that random password stored in your password manager and can be (with this standard you're commenting on) moved around wherever you want them. All passkey sites also support fallbacks to just password or other auth mode.
      • troupo 2y ago
        > They're in no way different than that random password stored in your password manager Except in all the ways that matter: they are not accessible to users, they are tied to third-party vendors.
        • izacus 2y ago
          [flagged]
          • reshlo 2y ago
            I’ll answer your question with a question: can you memorise your passkey for a given website?
            • xescure 2y ago
              What’s your point? Can you memorize SSH keys?
      • mzhaase 2y ago
        They are different from passwords in that they are never send over the web. They are a private key used to sign a challenge from the site.
        • dustyventure 2y ago
          The private keys are not sent to the relying party yet TFA is about a spec to send them over the web.
  • buro9 2y ago
    The second one is particularly pertinent: > Passkeys are essentially site-specific cryptographic keypairs, which are fine, combined with big tech company paternalism, which is intolerable.
    • deleted 2y ago
      [deleted]
  • ratorx 2y ago
    AFAIK, you can register your passkeys using your own provider (eg. Bitwarden). I’ve not personally used it too much, but the option is there. The remaining issue is moving the credentials between providers, which is an annoying limitation. But you can always add a different passkey to the site using the provider you want, so although annoying it is not the end of the world… The original limitation is similar to the usability of actual physical security keys, which (depending on the setup mode) are deliberately designed such that the private key material is not recoverable. Software based keys don’t HAVE to share the same limitation, but it seems more like a missing feature than attributing malice to the creators of the spec.
    • lapcat 2y ago
      > AFAIK, you can register your passkeys using your own provider (eg. Bitwarden). Why should we even need a third-party provider? Imagine needing a third-party "provider" for your own ssh keys.
      • joshuamorton 2y ago
        Do you use the same SSH keys on multiple devices? I certainly don't. If you need or wanted to (you don't) you'd need some way to sync them across multiple devices securely. When I use passkeys on a single device, the "provider" is the OS, same as with my SSH keys.
        • troupo 2y ago
          > Do you use the same SSH keys on multiple devices? Yes. For example, when upgrading or reinstalling a system > If you need or wanted to (you don't) you'd need some way to sync them across multiple devices securely. `scp -r` > the "provider" is the OS, same as with my SSH keys. And you have full access to ~/.ssh and you can move copy update rename delete them however you like. Without a "Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)" to move between blackboxes of third-party providers
          • 2y ago
  • lll-o-lll 2y ago
    This is an exceptionally cynical take. WebAuthn is an open standard; this new credential transfer spec is the opposite of “big vendor lock-in”. It’s standardising the export-import. Standards are slow and expensive to create and evolve. They involve endless meetings, discussion and design. However, the outcome is freedom. The idea that this should have been “extremely simple” is just standard hubris.
    • lapcat 2y ago
      > This is an exceptionally cynical take. > However, the outcome is freedom. This is an exceptionally naive take. > The idea that this should have been “extremely simple” is just standard hubris. Why? Export-import of passwords is extremely simple and can be done with copy-paste or CSV. The only thing preventing this with passkeys is the paternalistic idea that users of passkeys should not be allowed to access them directly.
      • joshuamorton 2y ago
        > The only thing preventing this with passkeys is the paternalistic idea that users of passkeys should not be allowed to access them directly. This is, of course, also the thing that makes passkeys uniquely unphishable.
        • Terr_ 2y ago
          That's a bit like saying a house fire is what makes your deleted files uniquely safe from recovery. The sentence is true, as far as it goes... But it's uniquely excessive, rather than the unique minimum sufficient for the task.
      • lll-o-lll 2y ago
        > FIDO Alliance’s credential exchange specifications define a standard format for transferring all types of credentials in a credential manager including passwords, passkeys and more in a manner that is secure by default. The hint of why this may be just slightly complicated is in that final phrase.
  • skybrian 2y ago
    Unlike your photo collection, passkeys aren’t precious. They’re just meaningless data. You can and should generate additional ones for each password manager you use, so you have multiple independent ways of getting into an account. As long as you can do that, everything is replaceable and there’s no lock-in. Similarly, I wouldn’t copy a private key for ssh to a new laptop. I generate a new one and copy the public key instead. It makes it easier to revoke access to the old computer. I do think this new spec will sometimes be useful for populating a new password manager, though.
    • jauntywundrkind 2y ago
      The proposal that any time o create an account o need multiple physical tokens or multiple password managers running is unbelievably stupid & fantastical. This whole project is doomed doomed doomed of this is the model. I've never seen a single sight suggest this either. Many have set up passkeys, but not one has prompted me to create a second. I have downloaded a lot of backup keys though. Sorry to be on blast here but every time passkeys come up the "use multiple keys" gets said & it's a joke. There needs to be a flow where I can create a passkey & have it replicate to a bunch of devices automatically; the current proposal that users need to gather all their security tokens & add each one is an absolute promise this technology is going to flop.
      • growse 2y ago
        > Sorry to be on blast here but every time passkeys come up the "use multiple keys" gets said & it's a joke. There needs to be a flow where I can create a passkey & have it replicate to a bunch of devices automatically Choose a passkey provider that supports this then. I use bitwarden. Other people use iOS keychain. Both work great.
      • skybrian 2y ago
        I bring it up because people claim there is lock-in and it’s not true. Apple and Google both replicate between devices, so there is some replication, within ecosystems. I only need to create a passkey twice per account so I can use both. It’s not a big deal, though replicating between them would be better. And so I am clearly not locked in. (Not because of passkeys, anyway.) If people think they’re locked in then it’s a “can’t be bothered” sort of lock-in. Clearly not fantastical since I’m doing it.
  • creatonez 2y ago
    > Instead, they took years to come up with some convoluted system where the only possibility is to transfer from one vendor lock-in to another vendor lock-in. Can someone explain how this actually works? Are the two backends required to send messages to each other to facilitate a transfer, or is it a simple encrypted export and import? Will it only facilitate transfers to trusted destinations?
  • jandrese 2y ago
    Personally, I've never met a cloud provider I would trust with holding my secret tokens. It just seems like such a juicy target for hackers. You have to trust that they have done everything right all of the time.
  • deleted 2y ago
    [deleted]
• rkagerer 2y ago
  Does this include a way for a technically-savvy user to 'repatriate' their passkeys into their own infrastructure? (i.e. If I want to be my own provider)
  • commandersaki 2y ago
    At a minimum we will see if KeePass is a provider that is supported; they seem to be the only pw manager in town that respect user freedom.
    • lovethevoid 2y ago
      KeepassXC already supports passkeys
    • rprospero 2y ago
      I'm curious if you count Pass (https://www.passwordstore.org/ https://www.passwordstore.org/) as not being "in town" or if it has issues with user freedom that I'm ignorant of.
      • commandersaki 2y ago
        Eh I should’ve qualified with pw managers that support passkeys.
  • ratorx 2y ago
    Can you not just set up a new passkey using a different provider (eg. Bitwarden)? It is a bit inconvenient, since it has to be done manually for every site.
    • whatevaa 2y ago
      A bit is understatement. If this passkeys become widespread, we are talking about like 100 sites.
      • ensignavenger 2y ago
• anilakar 2y ago
  OK. Let me know when I can migrate FIDO credentials from old Yubikeys to new ones. Earlier this year I almost lost a domain because $REGISTRAR forced 2FA and I had forgotten to add them to my key spreadsheet.
  • ithkuil 2y ago
    I think the whole point of yubikeys is to make this impossible. IIUC basically these devices contain one single immutable random secret that is stored in a tamper proof hardware and can never leave the device nor be written into another device. When you "create" new keys what actually happens under the hood is that a new value gets stored in flash memory which is the _combined_ with the hard secret with some key derivation scheme and the resulting secret is then the one used to perform cryptographic operations
    • pushupentry1219 2y ago
      Yeah whole point of YubiKey is that the physical key is REQUIRED and can't be cloned. So no, you won't be able export anything off of it. You're correct about how key creation works as well AFAIK.
    • abdullahkhalids 2y ago
      Yes, but nothing prevents someone from making a hardware security token that has a copyable memory. Some people will have a threat model where this is acceptable.
      • ithkuil 2y ago
        you can technically do that but that would be a very confusing use of the name "hardware security token". You can already use your phone today to store secrets with an acceptable threat model.
        • redserk 2y ago
          This is yet another security measure that completely ignores the real world and will become yet another security measure that gets ignored. People lose credentials all the time, from social security cards, to drivers licenses, and passports. Say a natural disaster hits and your laptop with Yubikey gets swept away in a flood? Congratulations, you're hosed! Individual people do not have the resources that a financial institution has. Getting people to adopt unique passwords is already an incredible hurdle, getting people to treat a hardware token literally more carefully than their social security card is bizarrely out of touch with reality. As for me, I use Keepass to store my Passkeys. I use a password and Yubikey to secure it. The Yubikey has the same exact private keys set as 2 others, so I can keep 1 on my keychain, 1 in my safe, and 1 at a relative's house. And even this would be an unreasonable effort to expect from the majority of people.
• itohihiyt 2y ago
  I only need one provider. A portable open source encrypted database I'm in control of and can back up and secure as needed. It's what I have now, and have had for years, in my password manager. I won't be at the mercy of a company or a device to access my digital life.
  • deleted 2y ago
    [deleted]
  • leokennis 2y ago
    That's cool, but the last thing I would want my mom to have to manage is a portable open source encrypted database shes's in control of and can back up and secure as needed.
    • saurik 2y ago
      Great; but, as long as a system supports the open solution, anyone can provide for you the closed one, while the opposite isn't the case.
      • izacus 2y ago
        And Passkeys is an open solution, what are you all going on about?
        • politelemon 2y ago
          Currently it is not. It was created provider centric so far, and in my reading of the spec, a thinly veiled lockin. The ability to move around should have been built in from the beginning but it was more beneficial for the providers to start without.
          • wolletd 2y ago
            Historically, the spec was written for hardware security tokens. Keys on those tokens can't be moved around by design. The whole "platform authenticator" thing enabling passkeys came later. Extending the spec that way was easy: a platform authenticator works just like a hardware authenticator, it just uses a different channel for communication. The spec the providers built upon just wasn't designed for software authenticators that allow moving around credentials. The original spec assumed credentials are stored in a non-extractable manner in HSMs. Edit: thinking about it, platform authenticators may have been in there pretty early, but under the assumption of also using an HSM and not allowing extraction of credentials. Providers compromised security for usability, removed the HSM and made passkeys synchronizable – the spec had to adapt.
• solarkraft 2y ago
  I had hope for passkeys, with all the interop-promises. It turned out that no (mainstream) passkey provider allows backups however, making them infinitely worse than just using passwords. Maybe this will help, but fuck me, it’s all complicated, especially for a damn foundational security mechanism! It could be so simple, just look at SSH keys, which I think largely use the same principle.
  • skybrian 2y ago
    You can create backup keys by creating more passkeys.
    • lelandbatey 2y ago
      That's not a backup, that's just another secret. If I can't record the secret onto paper that I can put in a safe deposit box at a bank (or several), then it ain't backed up.
      • dixie_land 2y ago
        I understand the semantic difference but wouldn't you be able to say add a "backup" Yubikey and lock it in a safe?
        • tjoff 2y ago
          Quite convenient when you need to create a new account...
        • eikenberry 2y ago
          No. How do you use it if it's in a safe? The only way this works is if you use the yubikey to log into google or some other auth provider and then use that auth provider for everything. But you are even worse off then as that auth provider now is a single point of failure... get that account revoked for any reason and you've lost access everywhere.
          • 2y ago
• MarkMarine 2y ago
  In one of the things that I do in my job, I run the auth system for a fintech, and passkeys are an incredible step forward for the typical user. Being able to migrate your passkeys between providers is a great step forward, I'm glad this is being implemented. Lots of complaints about passkeys and "big tech paternalism" in the comments here, and frankly I don't think ya'll deal with the middle of the bell curve user base that much. I've got users who, by literally no fault of their own, are being social engineered into reading back their SMS OTP codes to fake tech support. State of the art in industry is basically trying to understand every action that is happening on a device (via mobile phone network providers, location, their actions across multiple other sites, etc. etc. through vendors providing this type of intelligence... by vacuuming up all your data) to understand if fraud is happening by seeing if you can even trust the device that is getting the SMS. Every time we make a step forward in privacy, this gets harder and harder (fingerprinting devices is basically pointless now, so how do I tell if this should be a trusted device or not) so there is a driving force against improving user privacy coming from these vendors. Passkeys are the first positive step in auth I've seen in a decade that the average user will pickup and use, it helps them login and helps them not try to set a weak password they shared with multiple sites, and they can't read it back to a scammer who is fake tech support. Would I like passkeys to be more like ssh keys? um, maybe but I don't care about it one bit in practice. I use passkeys for everything I can and I've never once seen friction. The average user does not want to deal with backing up their passkeys or even thinking about them, heck most of them don't. If anyone in the comments doesn't like the implementation of webauthn, suggest changes to the spec and do the work to get it implemented instead of complaining about it in the comments.
  • ndriscoll 2y ago
    > If anyone in the comments doesn't like the implementation of webauthn, suggest changes to the spec Simple: clients meant for consumers SHALL NOT provide any attestation information. Those fields are intended to be used only by managed devices. People can be free to use a device that has guard rails for them. The issue is when e.g. my bank forces me to prove I am using a malware device, which is pretty much everything from "big tech". Normies will stay on the normal path anyway and will be using one of those devices, so there shouldn't be a need to block the people who are using something weird, because by definition they are not the average user.
• taeric 2y ago
  I'm super curious how this will ultimately work. As noted in another thread, secure enclaves aren't secure if they can be copied. Such that, if this is moving the passkey by copying it, I'm not at all clear on how that stays secure?
  • Scion9066 2y ago
    Generally this spec is talking about the kind of passkeys that are stored in password managers, not the kinds used by hardware security keys. Those in a password manager have always been technically copyable somehow, there just wasn't a standard format or protocol for doing so.
    • taeric 2y ago
      I knew that "passkey" had grown to refer to a set of different things. I can't say this upsets me, as it does sound like progress over the old status quo. Still, is confusing for those of us that bought in at the beginning.
      • lxgr 2y ago
        The terminology is definitely a mess, but I believe at least “passkey” has never referred to hardware authenticators. Those were usually called “security keys” or similar.
        • vanburen 2y ago
          Agree. Passkey should be reserved for credentials that can be synced or exported to different providers, as this is what is most analogous to a password from a user perspective. There should be a different standardized term used for hardware bound keys. So users wont get confused.
      • mjs 2y ago
        The Yubico FAQ explains some of the history fairly well: https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ In particular, they distinguish between "copyable" and "hardware-bound" passkeys. They're both passkeys, and can be used wherever passkeys are supported, but only the "hardware-bound" passkeys support attestation.
• jakub_g 2y ago
  Something that is not clear to me about passkeys and makes me uneasy to start using them: Are passkeys replacing passwords, 2FA, or both? What if I created a passkey on some device, lost that device, and my passkeys aren't cloud-backed-up? Would I be able to recover my account, or it's doomed? Or does it depend on how a given website implemented it?
  • rootusrootus 2y ago
    If the passkey is all you have, then you're doomed (at least to the extent of whatever alternative recovery procedures the vendor is making available to you). That's why it's pretty universal to provide backup codes to put in your safe when setting up a passkey.
    • create-username 2y ago
      you should have passkeys on at least two or three devices
      • EvanAnderson 2y ago
        Having one more thing to remember to do when I create a new account seems like the kind of tedious make-work computers should be automating.
        • rootusrootus 2y ago
          I agree. The better answer from my view is to handle passkeys like passwords and manage them the same way.
      • hedora 2y ago
        How do you keep those devices synced? I have over 500 accounts in my password manager. Do I need to manually set up 500 * 3 devices?
        • klausa 2y ago
• rootusrootus 2y ago
  This is good. One thing holding me back from fully embracing passkeys has been the inability to export passkeys in a format that I can store in a way that suits my preferences. This should solve that. Well, at least 1Password claims it will...
• dustyventure 2y ago
  I find it silly and backwards to implement this. One has a private key and one could use it to act as a ~CA attesting for the establishment of another key with the relying party. Then one would always know what the hell happened when keys inevitably end up getting compromised by the poor practices of some of the vendors.
  • greycol 2y ago
    It's clearly a compromise, but if we were going for a perfect implementation then everyone would have a local/self hosted soloution. This just means in the case of a bad vendor/unwanted default/change to a better vendor you can migrate away from them quickly (and not need to visit them again) without having to update all your pass keys at once. I'd expect good vendors to be popping up "You haven't updated your passkey for this site since you migrated to us, you should go to your account settings and do so" on login to a site.
    • dustyventure 2y ago
      Leaving everyone finding the custom way to update/add a passkey when the fix for that would prevent sharing keys and needing to manually do something 100-1000 times to regain a little security. The need for this compromise doesn't even make sense in light of all the past compromises. We pretty much know the RP is an an always online web site instead of variety U2F enables because that was apparently too hard and thrown out with everything else that didn't please always online keyvault makers.. Who is needing to compromise here?
• deleted 2y ago
  [deleted]
• teeray 2y ago
  What’s stopping providers from saying a collective “no” and forking the standard?
  • bastawhiz 2y ago
    "and forking the standard" isn't necessary if you're not going to implement it.
• karlkloss 2y ago
  If they can be moved, they can be stolen. This'll boost acceptance, but also open a can of worms.
  • lxgr 2y ago
    They can already be moved in proprietary ways. This just adds a standard one.
  • reshlo 2y ago
    Passkeys are terrifying, and I don’t understand why the companies pushing them are doing so. What are their motives? What do they gain from catastrophically increasing the risk that users completely lose access to our ability to conduct our lives? If someone steals my phone today, I can still access most of my accounts, and can regain access quickly to the others. Now let’s assume passkeys are ubiquitous and used to log in to every website. If they can’t be exported, then your entire digital existence is at the mercy of whatever device or technology platform you use to store your passkeys. If you lose access to the platform, you also permanently lose access to every single account you’ve ever signed up for. For me, that would include losing access to my retirement savings, tax records, and the ability to communicate with many of my friends, to give a few examples. My computer also doesn’t have Bluetooth, which means I can no longer log in to any websites on it even when I do have access to my passkeys.
    • Hypnosis6173 2y ago
      I mean, isn't the idea from them that you have 2 or more of them? Shure not everybody does that and some sites don't really support that but thinking about this concept of having "physical key s" to your data makes a lot of sense to me. Don't know how this change will affect my trust in the concept
      • reshlo 2y ago
        > I mean, isn't the idea from them that you have 2 or more of them? So now I need to buy an extra phone from a different manufacturer than the one I already own, or sign up for another paid service? I’m starting to see what their motive might be now. Is it even a requirement of the passkey standard to allow the user to create more than one passkey for your website?
• zigzag312 2y ago
  Password vs. Passkey: - Password is a single key, while passkey is a key-pair (private key & public key). - Password can be weak, while passkey is always strong. Password can be strong, if autogenerated. - When authenticating, password can be send to the server (depending on the authentication protocol; SCRAM or PAKE based protocols never send password to the server). With passkey, private key is not send to the server for authentication purposes. - Password manager can sync/backup your password and your passkey's "private" key. - For a single service, same password is used from all devices. Passkey can be different for each device, but I'm not sure how this works (if it works) with sync/backup. - Quantum-Safety: Key-derivation functions used with passwords are quantum-safe. Most (all?) asymmetric key algorithms, currently in commercial use (passkeys included), are not quantum-safe. I'm not an expert on the topic. That's just a summary of my current understanding of passkeys, if it helps anyone. Note that mistakes are possible.
  • geoelectric 2y ago
    Re you not being sure how sync would work with multi-device passkeys, you can share a passkey between devices with 1Password, Apple’s Keychain, etc, and use it to log in from any of them. I typically do this rather than manage them per-machine. Per-machine passkeys would ostensibly be better hygiene, but only if I somehow kept them unsynced (easier said than done if you’re using Keychain). Having to manage that process would probably be more mistake-prone than just using the single passkey from my encrypted 1Password store.
    • zigzag312 2y ago
      Yeah, multi-device passkeys are easy to sync. Per-machine passkeys sync would be interesting, as it could not just copy the private key (as then it wouldn't be per-machine anymore), but would need to generate a new passkey for each synced device. For example, if user has two devices with same password manager. To sync per-machine passkey from 1st to 2nd device, the password manager would have to initiate authentication with the service on the 2nd device and confirm it from the 1st device. I guess this process could be fully automated. The advantage is that this enables disabling passkey for a specific device. If a device is stolen, a password/passkey manager could be used to disable all passkeys tied to that device. Another advantage is that a private key doesn't need to be shared with a third-party. A cloud service provider doesn't need to ever see your private key, unless you also want to have a cloud based backup. But the passkey backed on the cloud would need to be an unique keypair and maybe even have a different authorization policy (e.g. requiring another authentication factor when using it).
• varjolintu 2y ago
  The worst thing about passkeys is how browser extensions must handle them: using JavaScript injections to the web page. Of course this means _any_ browser extension could do the same and be the man-in-the-middle inspecting the passkey creation and authentication. I'd be glad to have some kind of standard API behind a proper permission for handling passkeys.
  • taeric 2y ago
    The only thing that they should be able to intercept there, though, would be the specific passkey for the page you are authenticating with. With the specific challenge that was included, even. Such that it is not exportable to somewhere else for them to authenticate as you. Sure, it sucks that anything is interceptable. But this is still an improvement over the status quo.
• tdpvb 2y ago
  While better in many ways, broadly speaking this could mean no more throwaway accounts? Passkeys that require embedding on personal devices like cell phones means direct affiliation with your identity, no? Seems like a shadow benefit to industry is perfect ad targeting across the web.
  • dustyventure 2y ago
    No, a site can require attestation that you are on a kind of device but it can't correlate a key you have registered with it with one you create for any other site.
    • tdpvb 2y ago
      Right, but I imagine most sites will continue to use third-party authorization for passkeys, similar to Okto, Auth0, et al? They'd even be incentived to do so if it meant more granular user profiling -- all alongside third-party guarantees of "real verification", etc.
      • dustyventure 2y ago
        What 3rd party password/passkey manager you use is not the business of a site unlike when they list allowed single sign-on OAuth vendors.. And using the managers is an alternative to using a secure enclave correctly. Monopolists will try to erode options and force everything on to their platform but if they didn't succeed with OAuth I don't see them being further ahead with warping the fido standards to be like it.
• apple4ever 2y ago
  After seeing this and reading about future plans from the spec writer, I am never using passkeys. There is zero reason export should be so hard.