6 ms·

Psst: your employer is a vendor benefiting from said lock-in. Without a means for transfering from one password management resource to another, passkeys create

Psst: your employer is a vendor benefiting from said lock-in. Without a means for transfering from one password management resource to another, passkeys create an increasingly significant friction against migrating one's account and artifically reduces competitive pressure on the vendor. The phrase we use for that anti-consumer phenomenom is "vendor lock-in" (If your employer has an effective and practical import and export technique for passkeys, I would be delighted to hear so and apologize for the suggestion otherwise. But as far as I've seen, that's not a thing.)

forty 2y ago
Passkeys are still very much work in progress but there will be standard ways of transferring passkeys between password managers at least https://www.theverge.com/2024/10/15/24270875/password-manager-makers-transfer-passkeys-fido-alliance https://www.theverge.com/2024/10/15/24270875/password-manage... I'm not working specifically on passkeys lately so I don't know exactly what is already available to the public, I'll ask around
- tjoff 2y ago
  That is table stakes. So, rewind 5 years. Introduce that, remove attestation while you are at it. And make sure we have multiple compatible implementations. Without it passkeys are a sham. And since that was and is the case I don't see any conceivable future where passkeys benefit anyone but google/apple/ms. For the sake of the web it needs to die.
smw 2y ago
The expectation is that for any service you should be able to have multiple passkeys -- including multiple passkeys from different vendors. I'm not sure how that exactly causes lock in?
- CharlesW 2y ago
  Exactly, you can just register passkeys from multiple providers if that's a fear. Worst case (i.e. Google nukes your account and you've only set one passkey), you go through the usual email recovery or backup codes process and set a new one.
- o11c 2y ago
  That misses the overhead of having to rotate the passkeys for thousands of websites you've used them on.
jazzyjackson 2y ago
Being able to export a passkey sounds like a bug, not a feature. I was surprised that the spec was altered to allow hosting in the cloud at all, I thought it was more interesting as a means of keeping secrets in secure enclaves.

forty 2y ago

Passkeys are still very much work in progress but there will be standard ways of transferring passkeys between password managers at least https://www.theverge.com/2024/10/15/24270875/password-manager-makers-transfer-passkeys-fido-alliance https://www.theverge.com/2024/10/15/24270875/password-manage... I'm not working specifically on passkeys lately so I don't know exactly what is already available to the public, I'll ask around

tjoff 2y ago
That is table stakes. So, rewind 5 years. Introduce that, remove attestation while you are at it. And make sure we have multiple compatible implementations. Without it passkeys are a sham. And since that was and is the case I don't see any conceivable future where passkeys benefit anyone but google/apple/ms. For the sake of the web it needs to die.

smw 2y ago

The expectation is that for any service you should be able to have multiple passkeys -- including multiple passkeys from different vendors. I'm not sure how that exactly causes lock in?

CharlesW 2y ago
Exactly, you can just register passkeys from multiple providers if that's a fear. Worst case (i.e. Google nukes your account and you've only set one passkey), you go through the usual email recovery or backup codes process and set a new one.
o11c 2y ago
That misses the overhead of having to rotate the passkeys for thousands of websites you've used them on.

jazzyjackson 2y ago

Being able to export a passkey sounds like a bug, not a feature. I was surprised that the spec was altered to allow hosting in the cloud at all, I thought it was more interesting as a means of keeping secrets in secure enclaves.