5 ms·

So it's not just me! I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memori

So it's not just me! I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone. If I show up naked, I can login to the system via password but I am conpletely useless with a pass key. And for somebody like myself who uses multiple devices daily (two phones, two tablets, several laptops and desktops), it seems a nightmare to set them all up or maintain:-( It feels a system designed for those who live by their phone and trust some specific service provider with their life. I'm not in either of those categories :-(. I still don't understand what the "Keepass, "little black notebook", and "good memory" equivalents are.

portaouflop 2y ago
Idk I just set up both - email&password which live in my password manager and then passkeys for convenience - I can just hit a button without thinking and I’m in. It’s probably different for everyone but in case I have strictly separate devices- so a laptop where I have my work accounts and a desktop for games and some personal stuff. I don’t really use anything on a regular basis that needs accounts on my personal devices, but that’s probably very weird nowadays…
- sph 2y ago
  I already hit a button (the Bitwarden icon in my browser toolbar) so I do not see what passkeys buy me, except a terrible hassle the day I want to change password manager. It is a solution designed to lock people in the Apple/Google walled gardens, and I don't see why everybody is pushing for it.
  - izacus 2y ago
    Passkeys work fine with password managers like 1Password, KeePassXC, Bitwarden and others, why do you keep repeating this walled garden shtick? They're literally a cryptostring stored in your password manager just like your other passwords.
    - troupo 2y ago
      > They're literally a cryptostring stored in your password manager just like your other passwords. So I can copy paste them somewhere or move them around without "Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)"?
      - rcxdude 2y ago
        With Keepass you can, at least. Other ones not so much.
      - izacus 2y ago
        You can copy paste them using those formats. What are you arguing about here actually?
        FireBeyond 2y ago
        How does one get a passkey from iCloud into one of these formats? "You can't take your passkeys from Apple Passwords" s/iCloud/1Password? "There's not a way to import/export passkeys" s/iCloud/Google? So "you can copy paste them using those formats, if you can get them into those formats in the first place".
        lxgr 2y ago
        Apple actually does allow airdropping passkeys across devices and iCloud users! It’s clearly not (just) a security but a lock-in feature.
    - lxgr 2y ago
      Have you ever migrated one across password managers yourself? I tried; it currently seems impossible.
wolletd 2y ago
KeepassXC actually supports passkeys and can be a passkey provider in a desktop browser. And Android 14 seems to allow changing the passkey provider in the android system as well. With that, the only thing left would be a KeepassXC-compatible app that can serve as provider on android, using the same database as the desktop. With that setup, I'd be willing to use passkeys exclusively (my phone is still Android 13 and I don't know about app support). I already can't login anywhere (important) without access to my password manager.
- Dagonfly 2y ago
  Can confirm: Using Android 14 and Bitwarden, I can sign in to github.com using my passkey. It pops up a system dialog where I can select Bitwarden and then my Github username. Last time I checked, the Bitwarden Vault export included the whole FIDO credential including the private key.
  - wolletd 2y ago
    Bitwarden (and Lastpass, iirc) support passkeys a little longer than KeePassXC. I'm glad to hear they achieved full integration. As a keepass database is used by various open source clients from different vendors, it just takes a little longer to get all this done. But I'm sure we'll get there eventually.
- barkerja 2y ago
  > Android 14 seems to allow changing the passkey provider in the android system as well It's worth noting this is also supported in iOS and macOS. Settings > General > AutoFill & Passwords
izacus 2y ago
> I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone. There seems to be a lot of misunderstanding of passkeys indeed. They're in no way different than that random password stored in your password manager and can be (with this standard you're commenting on) moved around wherever you want them. All passkey sites also support fallbacks to just password or other auth mode.
- troupo 2y ago
  > They're in no way different than that random password stored in your password manager Except in all the ways that matter: they are not accessible to users, they are tied to third-party vendors.
  - izacus 2y ago
    [flagged]
    - reshlo 2y ago
      I’ll answer your question with a question: can you memorise your passkey for a given website?
      - xescure 2y ago
        What’s your point? Can you memorize SSH keys?
- mzhaase 2y ago
  They are different from passwords in that they are never send over the web. They are a private key used to sign a challenge from the site.
  - dustyventure 2y ago
    The private keys are not sent to the relying party yet TFA is about a spec to send them over the web.

portaouflop 2y ago

Idk I just set up both - email&password which live in my password manager and then passkeys for convenience - I can just hit a button without thinking and I’m in. It’s probably different for everyone but in case I have strictly separate devices- so a laptop where I have my work accounts and a desktop for games and some personal stuff. I don’t really use anything on a regular basis that needs accounts on my personal devices, but that’s probably very weird nowadays…

sph 2y ago
I already hit a button (the Bitwarden icon in my browser toolbar) so I do not see what passkeys buy me, except a terrible hassle the day I want to change password manager. It is a solution designed to lock people in the Apple/Google walled gardens, and I don't see why everybody is pushing for it.
- izacus 2y ago
  Passkeys work fine with password managers like 1Password, KeePassXC, Bitwarden and others, why do you keep repeating this walled garden shtick? They're literally a cryptostring stored in your password manager just like your other passwords.
  - troupo 2y ago
    > They're literally a cryptostring stored in your password manager just like your other passwords. So I can copy paste them somewhere or move them around without "Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)"?
    - rcxdude 2y ago
      With Keepass you can, at least. Other ones not so much.
    - izacus 2y ago
      You can copy paste them using those formats. What are you arguing about here actually?
      - FireBeyond 2y ago
        How does one get a passkey from iCloud into one of these formats? "You can't take your passkeys from Apple Passwords" s/iCloud/1Password? "There's not a way to import/export passkeys" s/iCloud/Google? So "you can copy paste them using those formats, if you can get them into those formats in the first place".
        lxgr 2y ago
        Apple actually does allow airdropping passkeys across devices and iCloud users! It’s clearly not (just) a security but a lock-in feature.
  - lxgr 2y ago
    Have you ever migrated one across password managers yourself? I tried; it currently seems impossible.

wolletd 2y ago

KeepassXC actually supports passkeys and can be a passkey provider in a desktop browser. And Android 14 seems to allow changing the passkey provider in the android system as well. With that, the only thing left would be a KeepassXC-compatible app that can serve as provider on android, using the same database as the desktop. With that setup, I'd be willing to use passkeys exclusively (my phone is still Android 13 and I don't know about app support). I already can't login anywhere (important) without access to my password manager.

Dagonfly 2y ago
Can confirm: Using Android 14 and Bitwarden, I can sign in to github.com using my passkey. It pops up a system dialog where I can select Bitwarden and then my Github username. Last time I checked, the Bitwarden Vault export included the whole FIDO credential including the private key.
- wolletd 2y ago
  Bitwarden (and Lastpass, iirc) support passkeys a little longer than KeePassXC. I'm glad to hear they achieved full integration. As a keepass database is used by various open source clients from different vendors, it just takes a little longer to get all this done. But I'm sure we'll get there eventually.
barkerja 2y ago
> Android 14 seems to allow changing the passkey provider in the android system as well It's worth noting this is also supported in iOS and macOS. Settings > General > AutoFill & Passwords

izacus 2y ago

> I feel like I either misunderstand pass keys or live in some twilight zone where they're ok even though I cannot wrote them down or memorize them, I can only have invisible magic stuck on my phone. There seems to be a lot of misunderstanding of passkeys indeed. They're in no way different than that random password stored in your password manager and can be (with this standard you're commenting on) moved around wherever you want them. All passkey sites also support fallbacks to just password or other auth mode.

troupo 2y ago
> They're in no way different than that random password stored in your password manager Except in all the ways that matter: they are not accessible to users, they are tied to third-party vendors.
- izacus 2y ago
  [flagged]
  - reshlo 2y ago
    I’ll answer your question with a question: can you memorise your passkey for a given website?
    - xescure 2y ago
      What’s your point? Can you memorize SSH keys?
mzhaase 2y ago
They are different from passwords in that they are never send over the web. They are a private key used to sign a challenge from the site.
- dustyventure 2y ago
  The private keys are not sent to the relying party yet TFA is about a spec to send them over the web.