3 ms·

Your password manager came from a vendor. As a thought exercise, switch vendors.

• EnPissant 1y ago
  Bitwarden exports include passkeys.
  • dboreham 1y ago
    Have you actually tried exporting a passkey and importing it into another manager, then successfully authenticate with it?
    • coldpie 1y ago
      KeepassXC lets you export the private key, which you can then back up or import into another KeepassXC instance. I have tested this, it works. I even shipped my exported private key off to a friend in another state and he was able to import it into a KeepassXC instance and log in to my account. Presumably another password manager could support importing the data, as it's just plaintext, though I don't know if any do. Unfortunately the spec authors think this export feature violates the spec and have threatened KeepassXC with being banned by authenticating websites[1]. This explicit support from the spec authors for client banning makes passkeys non-viable to me. The websites I log in to should not be able to restrict what clients I choose to use to manage my own data. [1] Spec author writes, "To be very honest here, you risk having KeePassXC blocked by relying parties. ... (RPs [may] block you, something that I have previously rallied against but rethinking as of late because of these situations)." https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407
      • timeflex 1y ago
        Furthermore, they "heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers." Basically, do what we say or expect us to have our corporate sponsors write bad press about your security.
    • EnPissant 1y ago
      Just having the data exported is peace of mind for me. It's trivial to import or convert to another format (even if not implemented now), so the worst-case scenario is acceptable, especially considering how much better Bitwarden + Passkeys are to every other form of authentication.
    • cyberax 1y ago
      BitWarden is OpenSource. I did try importing the export using my own hosted BitWarden server, it worked.
• koakuma-chan 1y ago
  https://blog.1password.com/fido-alliance-import-export-passkeys-draft-specs/ https://blog.1password.com/fido-alliance-import-export-passk...
  • recursive 1y ago
    > we have no interest in creating a walled garden or locking you into 1Password. They have no interest... in collecting subscription fees? I'm a satisfied 1Password customer, but it's hard to take this claim seriously. What does it mean? They literally get paid. Isn't that the definition of an interest?
    • koakuma-chan 1y ago
      Maybe they can get more customers by being based.
    • dataflow 1y ago
      I think you're thinking of incentive not interest. Like how you can have incentives to steal from the supermarket, but still have no interest.
      • recursive 1y ago
        I'm thinking of another definition of "interest". e.g. "have an interest in"