4 ms·

Yeah, I've been very disappointed that bitwarden haven't implemented passkey and OTP storage using a KMS. Sure, I'd have to be online then to use a passkey sto

• cyberax 2y ago
  > But it wouldn't something that could be stolen off bitwarden. Hah. I'm not the only one thinking about ways to use AWS KMS for it! But the attacker can still impersonate you and ask the HSM service to sign data for them. Ideally, I really want a system with a proof of physical interaction. The existing HSM APIs are not well-suited for that. But if you can trust the software that runs on the service that provides the HSM access, then this can be done with minor caveats on macOS.
  • jopsen 2y ago
    If the passkeys were stored in some cloud KMS, then yes someone could still impersonate me. Ideally, but they wouldn't be able to steal the keys, it would only be temporary. That said, yes, we'd have to trust the server side software that grants access to the keys in KMS. In the end this level of indirection would sort of defeat the point. It wouldn't really be better than OIDC using a provider where you have a passkey. Incidentally, I have 2FA on important accounts, and prefer to use Google/GitHub/Facebook for sign-in on other sites whenever possible.