8 ms·

In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, tran

In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys). Instead of "many cooks" mentioned in the article, there is one standard. I cannot bring myself to agree to any "switch to passkey" prompt from any device because I have no idea (and too tired to figure out) how and where that key will be stored, how do I deal with different devices, etc. I already have a universal solution for credentials: 1password, which is cross-platform. With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account and at best synced between devices from the same manufacturer. But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same. Like with many other solutions, the current approach with passkeys is designed for an imaginary "user in vacuum" model each company dreams about, where people are 100% into one ecosystem, forever.

YPPH 2y ago
>But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs You can't save your personal passkeys on your work phone and vice versa, but when logging in to a service on one device, you should be able use a passkey from the other device via Bluetooth by scanning a QR code.
- freetonik 2y ago
  Good to know, thanks! But I might not have the other device on me at all times.
  - asah 2y ago
    FIDO keys are tiny e.g. yubikey 5c
    - lxgr 2y ago
      If anything, this achieves the opposite of making sure I always have mine on me. Dedicated, external hardware authenticators are great for logging in to very high value accounts or password managers, but arguably they're not really viable for 99% of users and use cases on a day-to-day basis.
      - nixosbestos 2y ago
        I don't agree at all. It's on my keychain, next to my keys, a nice symmetry. When I need to login I hold it to the back of my phone for half a second. It's incredibly easy and would be even easier if it weren't for the UX presented by iOS, Android, and Windows where they try to be the provider. Android has gotten a bit better. Windows is the worst about it afaict.
        lxgr 2y ago
        Different people, different preferences. I don't like having to fetch my keys when I'm at home at all, which is where I do most of my authentications. I'd have to get up, walk to where I usually keep them, walk to my computer with them to authenticate, and then either walk back or forget the keys somewhere in the house and have to search for them when leaving (or detach the authenticator from the keychain and then not have it on me when I'm leaving). That's why I don't like using USB authenticators on a regular basis.
        ylk 2y ago
        It’s recommended to have at least two anyway, to still have access to your accounts in case one is lost. That means you can keep one key at your desktop and you’d only need to go up to get your keys when adding them to an account.
        lxgr 2y ago
        Having two in the same house is a pretty bad compromise. Ideally you'll want one of them to be physically somewhat distant (in case of a fire etc.), which makes things even less ergonomic.
- clcaev 2y ago
  An added challenge: Yubikey NFC doesn't work on iPad, only iPhone. USB operation also seems fraught. This has been so for 7+ years now. If Apple cannot get this to work with a closed ecosystem and the leading vendor, I think the technology is just not ready for mainstream.
  - samcat116 2y ago
    Yubikeys work on iPad and iPhone via USB perfectly fine now. I do it quite often.
    - haroldp 2y ago
      Woah, you are correct. My YubiKey 5C now works with my iPad M4! When did they fix that?? Edit: Looks like it was iPadOS 18.2 released on December 11th.
      - samcat116 2y ago
        I think they added better hardware key support at an OS level a little over two years ago. They needed all the web authn stuff for passkeys anyways, so I bet it was a necessity prerequisite.
        haroldp 2y ago
        I just got the new M4 iPad like two months ago, and my YubiKeys absolutely did not work, no matter what I tried. There are articles on apple.com and yubikey.com that explain that USB-C YubiKeys will not work with USB-C iPads because Apple's USB-C implementation isn't sending the timing info (or something like that) that the YubiKey needs to function. People were buying Lightening YubiKey and connecting them to Apple's Lightening to USB-C "camera adapter" to work around this. I decided to double-check my YubiKeys before I responded to your post and (!!!) they work now! This is huge!
  - lxgr 2y ago
    Apple is actually doing a lot of work (largely) in the background with every OS update. I was recently pleasantly surprised to be able to use my smartcard form factor FIDO authenticator on macOS using a CCID USB smartcard reader. Not exactly ergonomic on a laptop, but totally viable on a desktop or docking station setup with a permanently plugged in reader. Sometimes I really do miss that contactless card reader option that some Thinkpads offered...
gchamonlive 2y ago
Honest question, this isn't supposed to be a burn in any sense. But isn't it contradictory to want to know how and where your credentials are stored and use any credential management solution that isn't opensource and selfhosteable?
- freetonik 2y ago
  Fair enough, but I believe there is a spectrum between "I don't want to know things, let them just work" and "self-host and manage an application for storing the most sensitive type of information". 1Password is neither opensource nor self-hostable, and it stores data in the proprietary cloud (at least exports are easy). But I understand that and accept it. If I get a Macbook, an Android phone, and a Windows PC (a very popular combination of devices, btw), I honestly don't have energy to investigate how to inter-operate their passkey solutions. From the get go, I assume it's gonna be either impossible, or very hacky and fragile. Maybe I'm wrong, but last time I checked I simply walked away thinking "nope, no passkeys for me".
  - Aaron2222 2y ago
    1Password itself has native passkey support. I don't have experience with it on mobile, but on desktop browsers their extension overrides the build-in passkey support to use/store passkeys from/in 1Password (with a button to fall back to the built-in implementation for its storage, hardware tokens, QR code to use/store a passkey from/on a smartphone, etc).
    - Aaron2222 2y ago
      Looks like on iOS it integrates with the native passkey support (so is usable anywhere native passkeys are supported). 1Password on Android looks to have similar integration, but only for apps at this stage (not websites, due to an Android limitation). So still a little while to go yet for "it just works" across all platforms.
_Algernon_ 2y ago
>In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys). Instead of "many cooks" mentioned in the article, there is one standard. Ignoring site support, this exists. It's called USB and yubikey.
- anotherhue 2y ago
  Was called a SIM card before that.
  - formerly_proven 2y ago
    Both are smartcards. Yubikeys also happen to support the USB HID CTAP protocol, which is something unprivileged applications can usually talk to directly on most operating systems. Most other CTAP transports are just smartcard transports (APDUs over PC/SC or NFC). Yubikeys also have a PIV applet, which isn't used for your typical enterprise X.509 PKI, and an OpenPGP applet, which typically isn't used.
  - lxgr 2y ago
    PIV, GnuPG, or PKCS#15 are probably better comparisons. SIM cards use symmetric cryptography, which means you can only authenticate yourself to a single entity.
- deleted 2y ago
  [deleted]
- JumpCrisscross 2y ago
  > this exists. It's called USB and yubikey An extra physical device is a non-starter for mass adoption.
- Too 2y ago
  Having a big dongle sticking out of your iPhones lighning port is completely impractical, compared to using the integrated TPM backed storage, unlocked by face-id. Yes there are smaller dongles but only for usb-c and i still don't want to fiddle with it when charging. It's only a matter of time before desktops gain the same secure key storage as our phones do, add a hardware key to prove physical presence and then yubikeys are obsolete. The only future for yubikeys is for temporary transfer of keys under wrap between devices, where you don't want to use a cloud service for doing so. While an open api with replaceable internals is a nice idea and one that enabled yubikeys in the first place, once this is integrated in the SoC and the OS, there will be little need for alternative storage backends. What's more pressing now is pluggable synchronization of secrets, for those who don't want their choice of cloud provider to be bound to their choice of OS, or for those who rather synchronize entirely offline through a yubikey.
mihaaly 2y ago
> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account And from this account you may be locked out for various reasons anytime, as it happened to countless persons previously, violating exotic or even understandable rules, or just been in the crossfire of some galactic corporate incompetence (some f'd up), but this way you'd be locking yourself out of everything especially if you were that user in the vacuum, exposing yourself to the mercy of a single organization with changing managemenet and incentives as the wind turns in a city's dense downtown.
- skybrian 2y ago
  I solve this by creating two passkeys for each account, for iOS and Chrome. This covers all the devices I might use to log in and there’s no single point of failure.
  - HumanOstrich 2y ago
    That doesn't solve anything. You just have twice as many problems now.
    - skybrian 2y ago
      What are you talking about? Redundancy is how you avoid getting locked out. Each passkey serves as a backup for the other one. More generally, you should have two keys for any lock, so you can still get in if you lose one of them.
      - michaelt 2y ago
        Setting up both Apple and Google passkeys solves: * Lost access to your Google account, but still have access to your Apple account (or vice-versa) * Apple device doesn't support Google passkeys, or vice-versa But it multiplies the following downsides: * Apple/Google account gets hacked, hacker gets all your 2FA credentials * Snooping on your activity. Particularly Google, but Apple also have an advertising business. * Setting up accounts on new sites is twice the hassle. * Too complicated for the kind of folks who need the phishing protection passkeys provide.
paxys 2y ago
> I already have a universal solution for credentials: 1password, which is cross-platform. You can store passkeys in 1password so they work everywhere.
- NikolaNovak 2y ago
  The article is 80% about friction and confusion in trying that solution - from confusing prompts and endless questions designed to wrestle control over to local ecosystem, to use cases that just don't work with external vendor as opposed to native platform owner :-(
  - lxgr 2y ago
    Which use cases don't work with external implementations, but do with the first-party one? I have yet to encounter one on iOS and macOS.
    - pas 2y ago
      https://github.com/keepassxreboot/keepassxc/issues/10374 https://github.com/keepassxreboot/keepassxc/issues/10374 Passkeys not working on certain sites I suspect 1password also has at least a few sites that need special handling
- onetwothreepass 2y ago
  But 1password forces you to install the browser extension to do this.
ElFitz 2y ago
I don’t know about 1password, but proton pass supports passkeys, on both iOS, Safari & Chrome (and probably others).
- freehorse 2y ago
  I use proton pass and have the same issues as the author. Whenever macos/ios is in the mood it lets me use it to store passkeys, else it is an endless maze of bugs and confusion. Proton pass supports passkeys but the OS does not always let it communicate with the website.
  - lxgr 2y ago
    Any chance that this is actually due to websites requesting weird WebAuthN credential parameters (e.g. enforcing attestation, which software implementations by definition will not be able to support) or using the legacy U2F API? In my experience that's usually the culprit.
    - freehorse 2y ago
      No idea. I do not have the technical knowledge neither the time to check sth like that. I am totally clueless even as to where and how exactly passkeys are stored in my computer. For me they just work until they don’t. It does not really help in trusting them as password replacement.
loloquwowndueo 2y ago
Pretty sure 1password can store and use passkeys.
- sigzero 2y ago
  It certainly can.
  - 1oooqooq 2y ago
    until the time comes that it's used for spammers and everyone requires providers from a list that only included apple and Google. y'all trying very hard to not see where this will go.
    - lxgr 2y ago
      This would be possible via attestation, but both Apple and Google removed that feature when they replaced their respective device-bound authenticator implementations with cloud-synchronizing ones. (Google technically still allows creating device-bound ones and supports attestation in that case, but that's arguably a niche use case and not what people are talking about when they say "passkeys".)
- onetwothreepass 2y ago
  It does, but 1password forces you to use the browser extension in order to manage passkeys. I still don't trust browser extensions. I'm probably being irrational, but it is hard to find good sec info on how "safe" extensions really are.
  - Arnavion 2y ago
    If you're copy-pasting passwords from 1password into your browser you're making yourself vulnerable to phishing. The browser extension's autofill will at least check the domain name and prevent that.
    - pletnes 2y ago
grahamj 2y ago
I moved away from 1P some time ago due to their move to a subscription model. After trying other solutions and having high hopes for Apple finally shipping a passwords app I finally decided to move back this year. It's costly but excellent. I have several accounts shared with my wife and was getting caught up in the passkey problems you mentioned. Even though 1P handling OTP is not really 2FA it's very convenient and still more secure than no OTP. I also don't always want to have to have my phone on me. On top of that I like knowing that if I change my mind at some point I can export my credentials. Moving my iCloud keychain creds was an eye-opener: it felt purposefully painful. You can do it but much of the metadata is missing or lost in the process, with the titles being the URLs. Yuck.
- ramon156 2y ago
  Switching from 1p to icloud makes sense, but there's a decent chunk that isnt in the apple ecosystem. I'm keeping 1p for now, I'd even argue that the price is pretty good, especially for families.
  - grahamj 2y ago
    To be clear I never used iCloud/keychain exclusively, but my wife did and I performed the migration from that to 1P.
- onetwothreepass 2y ago
  I prefer to pay for something as important as a password manager. It's like some people get excited about all-you-can-eat sushi: sorry, but raw fish isn't something I want to go super-cheap with.
- apitman 2y ago
  Have you tried bitwarden?
  - grahamj 2y ago
    Yep that's mainly what I used. I trust it and it has a good feature set but the UX is just not up to snuff imo. I could get by with it but no way was I going to roll it out to my less techy family members. 1P is just much easier to use and more polished.
lxgr 2y ago
Using 1Password as your passkey backend seems like it would solve all the problems you're describing, except that passkeys are (for the time being, at least) locked in to 1Password [1]. It works on multiple OSes (as a native passkey backend on iOS, via browser extensions providing WebAuthN on all major OSes) and isn't tied to your Apple ID. If you care a lot about exportable passkeys, Bitwarden (and Vaultwarden) can export them. Not sure if any other implementation can import them at the moment, but the data looks portable enough (i.e. it contains the ECDSA private key and all other client properties required). [1] https://support.1password.com/save-use-passkeys/ https://support.1password.com/save-use-passkeys/ mentions that "Passkeys saved in 1Password can’t be exported at this time."
- radlad 2y ago
  1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passkeys-draft-specs/ https://blog.1password.com/fido-alliance-import-export-passk... KeePassXC also supports export but not yet using the aforementioned standard: https://github.com/keepassxreboot/keepassxc/issues/11363 https://github.com/keepassxreboot/keepassxc/issues/11363
  - maeil 2y ago
    > 1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passk https://blog.1password.com/fido-alliance-import-export-passk... See then believe, in the current environment saying "soon" based on 1password submitting a draft is much too optimistic, given the big interests Google and Apple have in neutering this possibility.
- sheepybloke 2y ago
  Same, I use bitwarden and it keeps all my passkeys in it and is available on all my devices.
- bobbob1921 2y ago
  I’m not saying I’m against 1pass adding the ability to export passkeys from 1Pass, however, doesn’t this increase the possibility of your computer is compromised (say remote control) and now your passkey is exported / moved to a new device and hacker auths in via that new device? (versus with a hardware passkey which cant be exported electronically)
pcl 2y ago
”But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same.” Apple has recently addressed this. You can now create shared groups, and selectively assign passwords and passkeys to the groups. You could easily create a group with your two identities and move the credentials to that group. https://support.apple.com/guide/iphone/share-passwords-iphe6b2b7043/ios https://support.apple.com/guide/iphone/share-passwords-iphe6...
- antgiant 2y ago
  Beware of the hidden catch here. The account that adds the credential to the group “owns” it. So if that account goes away for any reason so does the credential.
mcshicks 2y ago
Like this https://www.congress.gov/bill/118th-congress/senate-bill/884/text https://www.congress.gov/bill/118th-congress/senate-bill/884...
efitz 2y ago
I think that we should consider passing a law that a vendor may non disable “log in with” and supporting functionality like password recovery, for a user account for some lengthy period of time after involuntary termination of the user. But I think that the bigger issue is that I don’t think that large corporations should be allowed to disassociate with their users except in the case where criminal activity against that company is involved. This is especially important now that all the vendors want ecosystem lock-in AND have ToS that allow them to cancel pretty much arbitrarily.
- bobbob1921 2y ago
  Agreed, and some kind of appeals process/ external arbitrator, if your account is terminated due to terms of service or automation.
gwbas1c 2y ago
> is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys) Wow, that will immediately become a prime target for hackers / phishers.
- CamperBob2 2y ago
  So?
  - gwbas1c 2y ago
    Then we're getting to a point where the proposed law weakens passkeys to the point where they are much ado about nothing.
throw0101d 2y ago
> I cannot bring myself to agree to any "switch to passkey" prompt from any device because I have no idea (and too tired to figure out) how and where that key will be stored, how do I deal with different devices, etc. There is a draft standard in the works for export/import: * https://fidoalliance.org/specifications-credential-exchange-specifications/ https://fidoalliance.org/specifications-credential-exchange-...
joe_the_user 2y ago
each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys) Indeed and that law would provide overrides for the state. And which state, you might ask? All of them? The state where the device is manufactured? Hmm...
exabrial 2y ago
That was called "U2F", but we made it "better" with PassKeys!
deleted 2y ago
[deleted]
crooked-v 2y ago
> their single, universal, transferrable set of security credentials (like passkeys) That's an awful idea. Normal people already have a nightmare of a time with getting locked out of accounts, and now you want their entire lives to depend on a single hardware fob that can get lost?
musicale 2y ago
> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account and at best synced between devices from the same manufacturer. iCloud Keychain/Passwords works on macOS and Windows, and there are extensions for Chrome and Edge. I don't know whether it works with passkeys though. > But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same. As I understand it, Apple's BYOD support allows you to have a managed/corporate Apple ID and a personal Apple ID on the same device. You can also add a managed Apple ID to a personal device like an iPhone; on iOS (and possibly macOS?) it isolates the data between them so that corporate apps can't access personal data and vice-versa. I believe it's possible to have multiple accounts with separate Apple IDs, and I think it is possible to add "secondary" Apple IDs to a single account, but I don't have experience with this.
mystified5016 2y ago
Passkeys are the ideal identity management solution for spherical users in a vacuum
Mandatum 2y ago
> But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same. By design. This is what caused the ZenDesk, Atlassian, Disney and Sony hacks.

YPPH 2y ago

>But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs You can't save your personal passkeys on your work phone and vice versa, but when logging in to a service on one device, you should be able use a passkey from the other device via Bluetooth by scanning a QR code.

freetonik 2y ago
Good to know, thanks! But I might not have the other device on me at all times.
- asah 2y ago
  FIDO keys are tiny e.g. yubikey 5c
  - lxgr 2y ago
    If anything, this achieves the opposite of making sure I always have mine on me. Dedicated, external hardware authenticators are great for logging in to very high value accounts or password managers, but arguably they're not really viable for 99% of users and use cases on a day-to-day basis.
    - nixosbestos 2y ago
      I don't agree at all. It's on my keychain, next to my keys, a nice symmetry. When I need to login I hold it to the back of my phone for half a second. It's incredibly easy and would be even easier if it weren't for the UX presented by iOS, Android, and Windows where they try to be the provider. Android has gotten a bit better. Windows is the worst about it afaict.
      - lxgr 2y ago
        Different people, different preferences. I don't like having to fetch my keys when I'm at home at all, which is where I do most of my authentications. I'd have to get up, walk to where I usually keep them, walk to my computer with them to authenticate, and then either walk back or forget the keys somewhere in the house and have to search for them when leaving (or detach the authenticator from the keychain and then not have it on me when I'm leaving). That's why I don't like using USB authenticators on a regular basis.
        ylk 2y ago
        It’s recommended to have at least two anyway, to still have access to your accounts in case one is lost. That means you can keep one key at your desktop and you’d only need to go up to get your keys when adding them to an account.
        lxgr 2y ago
        Having two in the same house is a pretty bad compromise. Ideally you'll want one of them to be physically somewhat distant (in case of a fire etc.), which makes things even less ergonomic.
clcaev 2y ago
An added challenge: Yubikey NFC doesn't work on iPad, only iPhone. USB operation also seems fraught. This has been so for 7+ years now. If Apple cannot get this to work with a closed ecosystem and the leading vendor, I think the technology is just not ready for mainstream.
- samcat116 2y ago
  Yubikeys work on iPad and iPhone via USB perfectly fine now. I do it quite often.
  - haroldp 2y ago
    Woah, you are correct. My YubiKey 5C now works with my iPad M4! When did they fix that?? Edit: Looks like it was iPadOS 18.2 released on December 11th.
    - samcat116 2y ago
      I think they added better hardware key support at an OS level a little over two years ago. They needed all the web authn stuff for passkeys anyways, so I bet it was a necessity prerequisite.
      - haroldp 2y ago
        I just got the new M4 iPad like two months ago, and my YubiKeys absolutely did not work, no matter what I tried. There are articles on apple.com and yubikey.com that explain that USB-C YubiKeys will not work with USB-C iPads because Apple's USB-C implementation isn't sending the timing info (or something like that) that the YubiKey needs to function. People were buying Lightening YubiKey and connecting them to Apple's Lightening to USB-C "camera adapter" to work around this. I decided to double-check my YubiKeys before I responded to your post and (!!!) they work now! This is huge!
- lxgr 2y ago
  Apple is actually doing a lot of work (largely) in the background with every OS update. I was recently pleasantly surprised to be able to use my smartcard form factor FIDO authenticator on macOS using a CCID USB smartcard reader. Not exactly ergonomic on a laptop, but totally viable on a desktop or docking station setup with a permanently plugged in reader. Sometimes I really do miss that contactless card reader option that some Thinkpads offered...

gchamonlive 2y ago

Honest question, this isn't supposed to be a burn in any sense. But isn't it contradictory to want to know how and where your credentials are stored and use any credential management solution that isn't opensource and selfhosteable?

freetonik 2y ago
Fair enough, but I believe there is a spectrum between "I don't want to know things, let them just work" and "self-host and manage an application for storing the most sensitive type of information". 1Password is neither opensource nor self-hostable, and it stores data in the proprietary cloud (at least exports are easy). But I understand that and accept it. If I get a Macbook, an Android phone, and a Windows PC (a very popular combination of devices, btw), I honestly don't have energy to investigate how to inter-operate their passkey solutions. From the get go, I assume it's gonna be either impossible, or very hacky and fragile. Maybe I'm wrong, but last time I checked I simply walked away thinking "nope, no passkeys for me".
- Aaron2222 2y ago
  1Password itself has native passkey support. I don't have experience with it on mobile, but on desktop browsers their extension overrides the build-in passkey support to use/store passkeys from/in 1Password (with a button to fall back to the built-in implementation for its storage, hardware tokens, QR code to use/store a passkey from/on a smartphone, etc).
  - Aaron2222 2y ago
    Looks like on iOS it integrates with the native passkey support (so is usable anywhere native passkeys are supported). 1Password on Android looks to have similar integration, but only for apps at this stage (not websites, due to an Android limitation). So still a little while to go yet for "it just works" across all platforms.

_Algernon_ 2y ago

>In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys). Instead of "many cooks" mentioned in the article, there is one standard. Ignoring site support, this exists. It's called USB and yubikey.

anotherhue 2y ago
Was called a SIM card before that.
- formerly_proven 2y ago
  Both are smartcards. Yubikeys also happen to support the USB HID CTAP protocol, which is something unprivileged applications can usually talk to directly on most operating systems. Most other CTAP transports are just smartcard transports (APDUs over PC/SC or NFC). Yubikeys also have a PIV applet, which isn't used for your typical enterprise X.509 PKI, and an OpenPGP applet, which typically isn't used.
- lxgr 2y ago
  PIV, GnuPG, or PKCS#15 are probably better comparisons. SIM cards use symmetric cryptography, which means you can only authenticate yourself to a single entity.
deleted 2y ago
[deleted]
JumpCrisscross 2y ago
> this exists. It's called USB and yubikey An extra physical device is a non-starter for mass adoption.
Too 2y ago
Having a big dongle sticking out of your iPhones lighning port is completely impractical, compared to using the integrated TPM backed storage, unlocked by face-id. Yes there are smaller dongles but only for usb-c and i still don't want to fiddle with it when charging. It's only a matter of time before desktops gain the same secure key storage as our phones do, add a hardware key to prove physical presence and then yubikeys are obsolete. The only future for yubikeys is for temporary transfer of keys under wrap between devices, where you don't want to use a cloud service for doing so. While an open api with replaceable internals is a nice idea and one that enabled yubikeys in the first place, once this is integrated in the SoC and the OS, there will be little need for alternative storage backends. What's more pressing now is pluggable synchronization of secrets, for those who don't want their choice of cloud provider to be bound to their choice of OS, or for those who rather synchronize entirely offline through a yubikey.

mihaaly 2y ago

> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account And from this account you may be locked out for various reasons anytime, as it happened to countless persons previously, violating exotic or even understandable rules, or just been in the crossfire of some galactic corporate incompetence (some f'd up), but this way you'd be locking yourself out of everything especially if you were that user in the vacuum, exposing yourself to the mercy of a single organization with changing managemenet and incentives as the wind turns in a city's dense downtown.

skybrian 2y ago
I solve this by creating two passkeys for each account, for iOS and Chrome. This covers all the devices I might use to log in and there’s no single point of failure.
- HumanOstrich 2y ago
  That doesn't solve anything. You just have twice as many problems now.
  - skybrian 2y ago
    What are you talking about? Redundancy is how you avoid getting locked out. Each passkey serves as a backup for the other one. More generally, you should have two keys for any lock, so you can still get in if you lose one of them.
    - michaelt 2y ago
      Setting up both Apple and Google passkeys solves: * Lost access to your Google account, but still have access to your Apple account (or vice-versa) * Apple device doesn't support Google passkeys, or vice-versa But it multiplies the following downsides: * Apple/Google account gets hacked, hacker gets all your 2FA credentials * Snooping on your activity. Particularly Google, but Apple also have an advertising business. * Setting up accounts on new sites is twice the hassle. * Too complicated for the kind of folks who need the phishing protection passkeys provide.

paxys 2y ago

> I already have a universal solution for credentials: 1password, which is cross-platform. You can store passkeys in 1password so they work everywhere.

NikolaNovak 2y ago
The article is 80% about friction and confusion in trying that solution - from confusing prompts and endless questions designed to wrestle control over to local ecosystem, to use cases that just don't work with external vendor as opposed to native platform owner :-(
- lxgr 2y ago
  Which use cases don't work with external implementations, but do with the first-party one? I have yet to encounter one on iOS and macOS.
  - pas 2y ago
    https://github.com/keepassxreboot/keepassxc/issues/10374 https://github.com/keepassxreboot/keepassxc/issues/10374 Passkeys not working on certain sites I suspect 1password also has at least a few sites that need special handling
onetwothreepass 2y ago
But 1password forces you to install the browser extension to do this.

ElFitz 2y ago

I don’t know about 1password, but proton pass supports passkeys, on both iOS, Safari & Chrome (and probably others).

freehorse 2y ago
I use proton pass and have the same issues as the author. Whenever macos/ios is in the mood it lets me use it to store passkeys, else it is an endless maze of bugs and confusion. Proton pass supports passkeys but the OS does not always let it communicate with the website.
- lxgr 2y ago
  Any chance that this is actually due to websites requesting weird WebAuthN credential parameters (e.g. enforcing attestation, which software implementations by definition will not be able to support) or using the legacy U2F API? In my experience that's usually the culprit.
  - freehorse 2y ago
    No idea. I do not have the technical knowledge neither the time to check sth like that. I am totally clueless even as to where and how exactly passkeys are stored in my computer. For me they just work until they don’t. It does not really help in trusting them as password replacement.

loloquwowndueo 2y ago

Pretty sure 1password can store and use passkeys.

sigzero 2y ago
It certainly can.
- 1oooqooq 2y ago
  until the time comes that it's used for spammers and everyone requires providers from a list that only included apple and Google. y'all trying very hard to not see where this will go.
  - lxgr 2y ago
    This would be possible via attestation, but both Apple and Google removed that feature when they replaced their respective device-bound authenticator implementations with cloud-synchronizing ones. (Google technically still allows creating device-bound ones and supports attestation in that case, but that's arguably a niche use case and not what people are talking about when they say "passkeys".)
onetwothreepass 2y ago
It does, but 1password forces you to use the browser extension in order to manage passkeys. I still don't trust browser extensions. I'm probably being irrational, but it is hard to find good sec info on how "safe" extensions really are.
- Arnavion 2y ago
  If you're copy-pasting passwords from 1password into your browser you're making yourself vulnerable to phishing. The browser extension's autofill will at least check the domain name and prevent that.
  - pletnes 2y ago

grahamj 2y ago

I moved away from 1P some time ago due to their move to a subscription model. After trying other solutions and having high hopes for Apple finally shipping a passwords app I finally decided to move back this year. It's costly but excellent. I have several accounts shared with my wife and was getting caught up in the passkey problems you mentioned. Even though 1P handling OTP is not really 2FA it's very convenient and still more secure than no OTP. I also don't always want to have to have my phone on me. On top of that I like knowing that if I change my mind at some point I can export my credentials. Moving my iCloud keychain creds was an eye-opener: it felt purposefully painful. You can do it but much of the metadata is missing or lost in the process, with the titles being the URLs. Yuck.

ramon156 2y ago
Switching from 1p to icloud makes sense, but there's a decent chunk that isnt in the apple ecosystem. I'm keeping 1p for now, I'd even argue that the price is pretty good, especially for families.
- grahamj 2y ago
  To be clear I never used iCloud/keychain exclusively, but my wife did and I performed the migration from that to 1P.
onetwothreepass 2y ago
I prefer to pay for something as important as a password manager. It's like some people get excited about all-you-can-eat sushi: sorry, but raw fish isn't something I want to go super-cheap with.
apitman 2y ago
Have you tried bitwarden?
- grahamj 2y ago
  Yep that's mainly what I used. I trust it and it has a good feature set but the UX is just not up to snuff imo. I could get by with it but no way was I going to roll it out to my less techy family members. 1P is just much easier to use and more polished.

lxgr 2y ago

Using 1Password as your passkey backend seems like it would solve all the problems you're describing, except that passkeys are (for the time being, at least) locked in to 1Password [1]. It works on multiple OSes (as a native passkey backend on iOS, via browser extensions providing WebAuthN on all major OSes) and isn't tied to your Apple ID. If you care a lot about exportable passkeys, Bitwarden (and Vaultwarden) can export them. Not sure if any other implementation can import them at the moment, but the data looks portable enough (i.e. it contains the ECDSA private key and all other client properties required). [1] https://support.1password.com/save-use-passkeys/ https://support.1password.com/save-use-passkeys/ mentions that "Passkeys saved in 1Password can’t be exported at this time."

radlad 2y ago
1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passkeys-draft-specs/ https://blog.1password.com/fido-alliance-import-export-passk... KeePassXC also supports export but not yet using the aforementioned standard: https://github.com/keepassxreboot/keepassxc/issues/11363 https://github.com/keepassxreboot/keepassxc/issues/11363
- maeil 2y ago
  > 1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passk https://blog.1password.com/fido-alliance-import-export-passk... See then believe, in the current environment saying "soon" based on 1password submitting a draft is much too optimistic, given the big interests Google and Apple have in neutering this possibility.
sheepybloke 2y ago
Same, I use bitwarden and it keeps all my passkeys in it and is available on all my devices.
bobbob1921 2y ago
I’m not saying I’m against 1pass adding the ability to export passkeys from 1Pass, however, doesn’t this increase the possibility of your computer is compromised (say remote control) and now your passkey is exported / moved to a new device and hacker auths in via that new device? (versus with a hardware passkey which cant be exported electronically)

pcl 2y ago

”But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same.” Apple has recently addressed this. You can now create shared groups, and selectively assign passwords and passkeys to the groups. You could easily create a group with your two identities and move the credentials to that group. https://support.apple.com/guide/iphone/share-passwords-iphe6b2b7043/ios https://support.apple.com/guide/iphone/share-passwords-iphe6...

antgiant 2y ago
Beware of the hidden catch here. The account that adds the credential to the group “owns” it. So if that account goes away for any reason so does the credential.

mcshicks 2y ago

Like this https://www.congress.gov/bill/118th-congress/senate-bill/884/text https://www.congress.gov/bill/118th-congress/senate-bill/884...

efitz 2y ago

I think that we should consider passing a law that a vendor may non disable “log in with” and supporting functionality like password recovery, for a user account for some lengthy period of time after involuntary termination of the user. But I think that the bigger issue is that I don’t think that large corporations should be allowed to disassociate with their users except in the case where criminal activity against that company is involved. This is especially important now that all the vendors want ecosystem lock-in AND have ToS that allow them to cancel pretty much arbitrarily.

bobbob1921 2y ago
Agreed, and some kind of appeals process/ external arbitrator, if your account is terminated due to terms of service or automation.

gwbas1c 2y ago

> is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys) Wow, that will immediately become a prime target for hackers / phishers.

CamperBob2 2y ago
So?
- gwbas1c 2y ago
  Then we're getting to a point where the proposed law weakens passkeys to the point where they are much ado about nothing.

throw0101d 2y ago

> I cannot bring myself to agree to any "switch to passkey" prompt from any device because I have no idea (and too tired to figure out) how and where that key will be stored, how do I deal with different devices, etc. There is a draft standard in the works for export/import: * https://fidoalliance.org/specifications-credential-exchange-specifications/ https://fidoalliance.org/specifications-credential-exchange-...

joe_the_user 2y ago

each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys) Indeed and that law would provide overrides for the state. And which state, you might ask? All of them? The state where the device is manufactured? Hmm...

exabrial 2y ago

That was called "U2F", but we made it "better" with PassKeys!

deleted 2y ago

[deleted]

crooked-v 2y ago

> their single, universal, transferrable set of security credentials (like passkeys) That's an awful idea. Normal people already have a nightmare of a time with getting locked out of accounts, and now you want their entire lives to depend on a single hardware fob that can get lost?

musicale 2y ago

> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account and at best synced between devices from the same manufacturer. iCloud Keychain/Passwords works on macOS and Windows, and there are extensions for Chrome and Edge. I don't know whether it works with passkeys though. > But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same. As I understand it, Apple's BYOD support allows you to have a managed/corporate Apple ID and a personal Apple ID on the same device. You can also add a managed Apple ID to a personal device like an iPhone; on iOS (and possibly macOS?) it isolates the data between them so that corporate apps can't access personal data and vice-versa. I believe it's possible to have multiple accounts with separate Apple IDs, and I think it is possible to add "secondary" Apple IDs to a single account, but I don't have experience with this.

mystified5016 2y ago

Passkeys are the ideal identity management solution for spherical users in a vacuum

Mandatum 2y ago

> But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same. By design. This is what caused the ZenDesk, Atlassian, Disney and Sony hacks.