6 ms·

I came across an opinion I largely agree with: https://mastodon.social/@lapcatsoftware/113308133338196824 https://mastodon.social/@lapcatsoftware/11330813333819

• NikolaNovak 2y ago
  So it's not just me! I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone. If I show up naked, I can login to the system via password but I am conpletely useless with a pass key. And for somebody like myself who uses multiple devices daily (two phones, two tablets, several laptops and desktops), it seems a nightmare to set them all up or maintain:-( It feels a system designed for those who live by their phone and trust some specific service provider with their life. I'm not in either of those categories :-(. I still don't understand what the "Keepass, "little black notebook", and "good memory" equivalents are.
  • portaouflop 2y ago
    Idk I just set up both - email&password which live in my password manager and then passkeys for convenience - I can just hit a button without thinking and I’m in. It’s probably different for everyone but in case I have strictly separate devices- so a laptop where I have my work accounts and a desktop for games and some personal stuff. I don’t really use anything on a regular basis that needs accounts on my personal devices, but that’s probably very weird nowadays…
    • sph 2y ago
      I already hit a button (the Bitwarden icon in my browser toolbar) so I do not see what passkeys buy me, except a terrible hassle the day I want to change password manager. It is a solution designed to lock people in the Apple/Google walled gardens, and I don't see why everybody is pushing for it.
      • izacus 2y ago
        Passkeys work fine with password managers like 1Password, KeePassXC, Bitwarden and others, why do you keep repeating this walled garden shtick? They're literally a cryptostring stored in your password manager just like your other passwords.
        • troupo 2y ago
          > They're literally a cryptostring stored in your password manager just like your other passwords. So I can copy paste them somewhere or move them around without "Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)"?
          • rcxdude 2y ago
            With Keepass you can, at least. Other ones not so much.
          • izacus 2y ago
            You can copy paste them using those formats. What are you arguing about here actually?
            • FireBeyond 2y ago
              How does one get a passkey from iCloud into one of these formats? "You can't take your passkeys from Apple Passwords" s/iCloud/1Password? "There's not a way to import/export passkeys" s/iCloud/Google? So "you can copy paste them using those formats, if you can get them into those formats in the first place".
  • wolletd 2y ago
    KeepassXC actually supports passkeys and can be a passkey provider in a desktop browser. And Android 14 seems to allow changing the passkey provider in the android system as well. With that, the only thing left would be a KeepassXC-compatible app that can serve as provider on android, using the same database as the desktop. With that setup, I'd be willing to use passkeys exclusively (my phone is still Android 13 and I don't know about app support). I already can't login anywhere (important) without access to my password manager.
    • Dagonfly 2y ago
      Can confirm: Using Android 14 and Bitwarden, I can sign in to github.com using my passkey. It pops up a system dialog where I can select Bitwarden and then my Github username. Last time I checked, the Bitwarden Vault export included the whole FIDO credential including the private key.
      • wolletd 2y ago
        Bitwarden (and Lastpass, iirc) support passkeys a little longer than KeePassXC. I'm glad to hear they achieved full integration. As a keepass database is used by various open source clients from different vendors, it just takes a little longer to get all this done. But I'm sure we'll get there eventually.
    • barkerja 2y ago
      > Android 14 seems to allow changing the passkey provider in the android system as well It's worth noting this is also supported in iOS and macOS. Settings > General > AutoFill & Passwords
  • izacus 2y ago
    > I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone. There seems to be a lot of misunderstanding of passkeys indeed. They're in no way different than that random password stored in your password manager and can be (with this standard you're commenting on) moved around wherever you want them. All passkey sites also support fallbacks to just password or other auth mode.
    • troupo 2y ago
      > They're in no way different than that random password stored in your password manager Except in all the ways that matter: they are not accessible to users, they are tied to third-party vendors.
      • izacus 2y ago
        [flagged]
        • reshlo 2y ago
          I’ll answer your question with a question: can you memorise your passkey for a given website?
          • xescure 2y ago
            What’s your point? Can you memorize SSH keys?
    • mzhaase 2y ago
      They are different from passwords in that they are never send over the web. They are a private key used to sign a challenge from the site.
      • dustyventure 2y ago
        The private keys are not sent to the relying party yet TFA is about a spec to send them over the web.
• buro9 2y ago
  The second one is particularly pertinent: > Passkeys are essentially site-specific cryptographic keypairs, which are fine, combined with big tech company paternalism, which is intolerable.
  • deleted 2y ago
    [deleted]
• ratorx 2y ago
  AFAIK, you can register your passkeys using your own provider (eg. Bitwarden). I’ve not personally used it too much, but the option is there. The remaining issue is moving the credentials between providers, which is an annoying limitation. But you can always add a different passkey to the site using the provider you want, so although annoying it is not the end of the world… The original limitation is similar to the usability of actual physical security keys, which (depending on the setup mode) are deliberately designed such that the private key material is not recoverable. Software based keys don’t HAVE to share the same limitation, but it seems more like a missing feature than attributing malice to the creators of the spec.
  • lapcat 2y ago
    > AFAIK, you can register your passkeys using your own provider (eg. Bitwarden). Why should we even need a third-party provider? Imagine needing a third-party "provider" for your own ssh keys.
    • joshuamorton 2y ago
      Do you use the same SSH keys on multiple devices? I certainly don't. If you need or wanted to (you don't) you'd need some way to sync them across multiple devices securely. When I use passkeys on a single device, the "provider" is the OS, same as with my SSH keys.
      • troupo 2y ago
        > Do you use the same SSH keys on multiple devices? Yes. For example, when upgrading or reinstalling a system > If you need or wanted to (you don't) you'd need some way to sync them across multiple devices securely. `scp -r` > the "provider" is the OS, same as with my SSH keys. And you have full access to ~/.ssh and you can move copy update rename delete them however you like. Without a "Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)" to move between blackboxes of third-party providers
        • 2y ago
• lll-o-lll 2y ago
  This is an exceptionally cynical take. WebAuthn is an open standard; this new credential transfer spec is the opposite of “big vendor lock-in”. It’s standardising the export-import. Standards are slow and expensive to create and evolve. They involve endless meetings, discussion and design. However, the outcome is freedom. The idea that this should have been “extremely simple” is just standard hubris.
  • lapcat 2y ago
    > This is an exceptionally cynical take. > However, the outcome is freedom. This is an exceptionally naive take. > The idea that this should have been “extremely simple” is just standard hubris. Why? Export-import of passwords is extremely simple and can be done with copy-paste or CSV. The only thing preventing this with passkeys is the paternalistic idea that users of passkeys should not be allowed to access them directly.
    • joshuamorton 2y ago
      > The only thing preventing this with passkeys is the paternalistic idea that users of passkeys should not be allowed to access them directly. This is, of course, also the thing that makes passkeys uniquely unphishable.
      • Terr_ 2y ago
        That's a bit like saying a house fire is what makes your deleted files uniquely safe from recovery. The sentence is true, as far as it goes... But it's uniquely excessive, rather than the unique minimum sufficient for the task.
    • lll-o-lll 2y ago
      > FIDO Alliance’s credential exchange specifications define a standard format for transferring all types of credentials in a credential manager including passwords, passkeys and more in a manner that is secure by default. The hint of why this may be just slightly complicated is in that final phrase.
• skybrian 2y ago
  Unlike your photo collection, passkeys aren’t precious. They’re just meaningless data. You can and should generate additional ones for each password manager you use, so you have multiple independent ways of getting into an account. As long as you can do that, everything is replaceable and there’s no lock-in. Similarly, I wouldn’t copy a private key for ssh to a new laptop. I generate a new one and copy the public key instead. It makes it easier to revoke access to the old computer. I do think this new spec will sometimes be useful for populating a new password manager, though.
  • jauntywundrkind 2y ago
    The proposal that any time o create an account o need multiple physical tokens or multiple password managers running is unbelievably stupid & fantastical. This whole project is doomed doomed doomed of this is the model. I've never seen a single sight suggest this either. Many have set up passkeys, but not one has prompted me to create a second. I have downloaded a lot of backup keys though. Sorry to be on blast here but every time passkeys come up the "use multiple keys" gets said & it's a joke. There needs to be a flow where I can create a passkey & have it replicate to a bunch of devices automatically; the current proposal that users need to gather all their security tokens & add each one is an absolute promise this technology is going to flop.
    • growse 2y ago
      > Sorry to be on blast here but every time passkeys come up the "use multiple keys" gets said & it's a joke. There needs to be a flow where I can create a passkey & have it replicate to a bunch of devices automatically Choose a passkey provider that supports this then. I use bitwarden. Other people use iOS keychain. Both work great.
    • skybrian 2y ago
      I bring it up because people claim there is lock-in and it’s not true. Apple and Google both replicate between devices, so there is some replication, within ecosystems. I only need to create a passkey twice per account so I can use both. It’s not a big deal, though replicating between them would be better. And so I am clearly not locked in. (Not because of passkeys, anyway.) If people think they’re locked in then it’s a “can’t be bothered” sort of lock-in. Clearly not fantastical since I’m doing it.
• creatonez 2y ago
  > Instead, they took years to come up with some convoluted system where the only possibility is to transfer from one vendor lock-in to another vendor lock-in. Can someone explain how this actually works? Are the two backends required to send messages to each other to facilitate a transfer, or is it a simple encrypted export and import? Will it only facilitate transfers to trusted destinations?
• jandrese 2y ago
  Personally, I've never met a cloud provider I would trust with holding my secret tokens. It just seems like such a juicy target for hackers. You have to trust that they have done everything right all of the time.
• deleted 2y ago
  [deleted]