5 ms·

Are passkeys seeing any traction?

nixpulvis 1y ago
I don't use them much because I don't have a good way to register them and use them across device ecosystems. I use all three OSes regularly.
- WorldMaker 1y ago
  1Password and BitWarden both support Passkey sync across all three OSes. Though if you are using Android regularly enough that may imply you trust Google implicitly enough that you probably could also just get away with Chrome Passkey sync which I'm told also works on all three OSes today. Or treat it as an opportunity to try to avoid "vendor lock-in"/increase redundancy by using all three to have 3+ passkeys in every service. Windows 11 can act as useful a bridge for bootstrapping all of your keys into a service: register for a site first on iOS or Android, use Windows 11 bluetooth to login via the first passkey, add a Windows passkey, and use Windows 11 bluetooth again to add the third. (Or some combo of that with the Windows iCloud Passwords app and/or Chrome.)
  - nixpulvis 1y ago
    I guess I'm partially just stubborn because I don't want to pay for what should be a cross platform standard.
    - coldpie 1y ago
      KeepassXC is a good client that lets you handle your data how you want. I wrote a pro-Passkey blog post here[1] that explains how to do your own syncing, though I later discovered Passkeys are explicitly built to support proprietary software vendor lock in and had to revoke my support. If you are concerned about being able to control your own data outside of the big tech ecosystem, I strongly recommend avoiding passkeys entirely. It is possible for now, but they are not built for that and the spec authors are actively hostile to you managing your own data. [1] https://www.smokingonabike.com/2025/01/04/passkey-marketing-is-lying-to-you/ https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
      - timeflex 1y ago
        That is what I've noticed as well. The thread regarding KeePassXC is crazy... straight up threatening negative PR because KeePassXC allows people to store their private key, demanding that they instead take away user choice and modify their app to hide & prevent users from doing things. Passkeys appear to me to be nothing more than a corporate gimmick, and to be honest, I personally think in many instances they actually make you less secure... getting a fingerprint is way easier than making someone tell you their password. Now days the intelligence agencies likely already have your fingerprints as well.
        hooverd 1y ago
        They're a great technology that the FIDO Alliance is trying their best to cripple.
    - WorldMaker 1y ago
      I also meant to mention that many Keepass clients support Passkeys already today. Strongbox on iOS and macOS has similar or better integration to 1Password/BitWarden. Windows you probably want KeepassXC for now as it isn't fully baked in mainline Keepass. I don't know what you'd use on Android today, but I'm sure there's at least one and probably more on the way.
    - lxgr 1y ago
      Bitwarden is free, and if you are concerned about these terms changing, the excellent self-hosted open source server implementation "vaultwarden" [1] supports passkeys as well. [1] https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden
    - arccy 1y ago
      The Google / Chrome sync is free
      - nixpulvis 1y ago
        Free != standard.
throwaway314155 1y ago
Yep
SchemaLoad 1y ago
I've got no overall stats but they are very well integrated in to iOS. You could end up using them without really even knowing what passkeys are. Websites and apps just prompt you with "add a passkey" and if you hit accept you get one and it gets synced to all your other Apple devices and just works.
commandersaki 1y ago
I hope 1Password release passkey unlock for vaults soon. Then I'll never have to enter the passphrase to unlock again, and my "passphrase" will be essentially the unlock code for my phone.
- atonse 1y ago
  You can already unlock 1Password using biometrics in your Apple devices. they do ask you for your password every 2 weeks though. But I think that's a great balance. ...Unless I misunderstood what you're talking about. When I put in a passkey, 1p just asks me to press a button, not re-unlock.
  - commandersaki 1y ago
    With a passkey you would have one in keychain that unlocks 1p. So you will only be asked for your phone password/unlock code whenever iOS asks, but it will be used to unlock 1P. Never need to enter your 1P passphrase.
    - atonse 1y ago
      I still don’t follow. So instead of 1 password that you remember, there would now be a passkey? I feel that is too risky. Where would you store that passkey? And what if you lose it? I suppose the 1p emergency kit could print out a QR code or something.
      - commandersaki 1y ago
        The passkey is stored in the secure enclave which is protected by your unlock code & biometrics (for fast unlock), or whatever the equivalent is for Google. You're not replacing your secret key / passphrase, it's just a different way to authenticate and decrypt vaults. It's really more a convenience on a handheld device where entering a passphrase (mine is 20 characters) is a pain in the arse. Though, if it were available for macOS, I would use it there too.
vbezhenar 1y ago
They are still not implemented in major browsers and operating systems (e.g. Linux Chrome), so not likely much traction.
- arccy 1y ago
  This is a straight up lie. They've been in Linux Chrome for quite some time now.
  - vbezhenar 1y ago
    This is a straight up lie. Here's a screenshot from my PC: https://0x0.st/8v8T.png https://0x0.st/8v8T.png Not implemented.
    - thebytefairy 1y ago
      Google documentation states in multiple places that passkeys are supported in chrome Linux via google password manager. I haven't tried myself, are you saying that is incorrect?
      - vbezhenar 1y ago
        I was wrong and I'm sorry about it. Turned out, I disabled one setting in my Google Chrome password manager, which apparently also disabled passkey creation functionality. https://issues.chromium.org/issues/417941069 https://issues.chromium.org/issues/417941069 more here. For my excuse I should note, that this passkey support is relatively recent (end of 2024) and error message was really unhelpful to understand the issue. I was trying to use passkeys on my Linux computer like every few months since they started to appear on various websites and was frustrated by lack of support in Linux. Thanks for pushing me into right direction, so at least I can now use them.
jeroenhd 1y ago
I've used them across Chrome, Firefox, and Safari on Linux, macOS, and Windows (10 and 11) for large websites. I've used them for Github, as 2FA on various services, and as the primary login for some websites, such as the local grocery store (Albert Heijn). I also use them for authenticating to my personal Keycloak server which acts as a guard for a whole bunch of services in my network. Support is far from universal, but it's definitely getting better. Unfortunately, protocols such as CTAP2 don't seem to have been implemented on Linux, so it lacks the "log in using your phone" prompt that makes them super useful on proprietary operating systems (like fingerprint/touch ID, but without needing to add every device manually).
EbNar 1y ago
At the moment, I'm going to avoid them as long as I can. It's not that I don't like the concept, but I think that a strong password + 2FA is already "enough" and I don't need to add complexity to my setup. No, I don't really fear phishing.
- nusl 1y ago
  Passkeys reduce complexity, at least in my experience. A single click versus entering credentials then finding the 2FA pin on your phone or something.
  - EbNar 1y ago
    By "complexity" I meant that they are "opaque" to me and somewhat not tied to and identity (be it email or username). Maybe it's me being inept, but I used them once or twice just for fun in Bitwarden and now I can't find them anywhere in my vault. https://community.bitwarden.com/t/special-vault-search-keyword-for-entries-with-passkeys/62187 https://community.bitwarden.com/t/special-vault-search-keywo... Maybe it's just a Bitwarden issue. The 2FA issue isn't such for me. As I explained in a different comment, 2FA pins are copied automatically and are thus just a "ctrl+v" away.
    - nusl 1y ago
      Perhaps a Bitwarden issue. I had them in 1Password and used them without any problems, then moved them out and into my Apple Keychain to separate those concerns a bit better. Both solutions work pretty well. Having to pull my phone out or go and find/fetch it to grab a pin is pretty annoying for me, since I also don't keep them in my password manager. I did for a long time but figured that if my password manager was compromised I would be royally screwed since they'd have my 2FA there to, meaning the password manager is actually a weak point.
ellisv 1y ago
Yes/no. I have a few passkeys in my vault but several are for different accounts with the same company (e.g. Amazon, Google). I expect adoption to continue but will take years.

I don't use them much because I don't have a good way to register them and use them across device ecosystems. I use all three OSes regularly.

WorldMaker 1y ago
1Password and BitWarden both support Passkey sync across all three OSes. Though if you are using Android regularly enough that may imply you trust Google implicitly enough that you probably could also just get away with Chrome Passkey sync which I'm told also works on all three OSes today. Or treat it as an opportunity to try to avoid "vendor lock-in"/increase redundancy by using all three to have 3+ passkeys in every service. Windows 11 can act as useful a bridge for bootstrapping all of your keys into a service: register for a site first on iOS or Android, use Windows 11 bluetooth to login via the first passkey, add a Windows passkey, and use Windows 11 bluetooth again to add the third. (Or some combo of that with the Windows iCloud Passwords app and/or Chrome.)
- nixpulvis 1y ago
  I guess I'm partially just stubborn because I don't want to pay for what should be a cross platform standard.
  - coldpie 1y ago
    KeepassXC is a good client that lets you handle your data how you want. I wrote a pro-Passkey blog post here[1] that explains how to do your own syncing, though I later discovered Passkeys are explicitly built to support proprietary software vendor lock in and had to revoke my support. If you are concerned about being able to control your own data outside of the big tech ecosystem, I strongly recommend avoiding passkeys entirely. It is possible for now, but they are not built for that and the spec authors are actively hostile to you managing your own data. [1] https://www.smokingonabike.com/2025/01/04/passkey-marketing-is-lying-to-you/ https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
    - timeflex 1y ago
      That is what I've noticed as well. The thread regarding KeePassXC is crazy... straight up threatening negative PR because KeePassXC allows people to store their private key, demanding that they instead take away user choice and modify their app to hide & prevent users from doing things. Passkeys appear to me to be nothing more than a corporate gimmick, and to be honest, I personally think in many instances they actually make you less secure... getting a fingerprint is way easier than making someone tell you their password. Now days the intelligence agencies likely already have your fingerprints as well.
      - hooverd 1y ago
        They're a great technology that the FIDO Alliance is trying their best to cripple.
  - WorldMaker 1y ago
    I also meant to mention that many Keepass clients support Passkeys already today. Strongbox on iOS and macOS has similar or better integration to 1Password/BitWarden. Windows you probably want KeepassXC for now as it isn't fully baked in mainline Keepass. I don't know what you'd use on Android today, but I'm sure there's at least one and probably more on the way.
  - lxgr 1y ago
    Bitwarden is free, and if you are concerned about these terms changing, the excellent self-hosted open source server implementation "vaultwarden" [1] supports passkeys as well. [1] https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden
  - arccy 1y ago
    The Google / Chrome sync is free
    - nixpulvis 1y ago
      Free != standard.

throwaway314155 1y ago

Yep

SchemaLoad 1y ago

I've got no overall stats but they are very well integrated in to iOS. You could end up using them without really even knowing what passkeys are. Websites and apps just prompt you with "add a passkey" and if you hit accept you get one and it gets synced to all your other Apple devices and just works.

commandersaki 1y ago

I hope 1Password release passkey unlock for vaults soon. Then I'll never have to enter the passphrase to unlock again, and my "passphrase" will be essentially the unlock code for my phone.

atonse 1y ago
You can already unlock 1Password using biometrics in your Apple devices. they do ask you for your password every 2 weeks though. But I think that's a great balance. ...Unless I misunderstood what you're talking about. When I put in a passkey, 1p just asks me to press a button, not re-unlock.
- commandersaki 1y ago
  With a passkey you would have one in keychain that unlocks 1p. So you will only be asked for your phone password/unlock code whenever iOS asks, but it will be used to unlock 1P. Never need to enter your 1P passphrase.
  - atonse 1y ago
    I still don’t follow. So instead of 1 password that you remember, there would now be a passkey? I feel that is too risky. Where would you store that passkey? And what if you lose it? I suppose the 1p emergency kit could print out a QR code or something.
    - commandersaki 1y ago
      The passkey is stored in the secure enclave which is protected by your unlock code & biometrics (for fast unlock), or whatever the equivalent is for Google. You're not replacing your secret key / passphrase, it's just a different way to authenticate and decrypt vaults. It's really more a convenience on a handheld device where entering a passphrase (mine is 20 characters) is a pain in the arse. Though, if it were available for macOS, I would use it there too.

vbezhenar 1y ago

They are still not implemented in major browsers and operating systems (e.g. Linux Chrome), so not likely much traction.

arccy 1y ago
This is a straight up lie. They've been in Linux Chrome for quite some time now.
- vbezhenar 1y ago
  This is a straight up lie. Here's a screenshot from my PC: https://0x0.st/8v8T.png https://0x0.st/8v8T.png Not implemented.
  - thebytefairy 1y ago
    Google documentation states in multiple places that passkeys are supported in chrome Linux via google password manager. I haven't tried myself, are you saying that is incorrect?
    - vbezhenar 1y ago
      I was wrong and I'm sorry about it. Turned out, I disabled one setting in my Google Chrome password manager, which apparently also disabled passkey creation functionality. https://issues.chromium.org/issues/417941069 https://issues.chromium.org/issues/417941069 more here. For my excuse I should note, that this passkey support is relatively recent (end of 2024) and error message was really unhelpful to understand the issue. I was trying to use passkeys on my Linux computer like every few months since they started to appear on various websites and was frustrated by lack of support in Linux. Thanks for pushing me into right direction, so at least I can now use them.

jeroenhd 1y ago

I've used them across Chrome, Firefox, and Safari on Linux, macOS, and Windows (10 and 11) for large websites. I've used them for Github, as 2FA on various services, and as the primary login for some websites, such as the local grocery store (Albert Heijn). I also use them for authenticating to my personal Keycloak server which acts as a guard for a whole bunch of services in my network. Support is far from universal, but it's definitely getting better. Unfortunately, protocols such as CTAP2 don't seem to have been implemented on Linux, so it lacks the "log in using your phone" prompt that makes them super useful on proprietary operating systems (like fingerprint/touch ID, but without needing to add every device manually).

EbNar 1y ago

At the moment, I'm going to avoid them as long as I can. It's not that I don't like the concept, but I think that a strong password + 2FA is already "enough" and I don't need to add complexity to my setup. No, I don't really fear phishing.

nusl 1y ago
Passkeys reduce complexity, at least in my experience. A single click versus entering credentials then finding the 2FA pin on your phone or something.
- EbNar 1y ago
  By "complexity" I meant that they are "opaque" to me and somewhat not tied to and identity (be it email or username). Maybe it's me being inept, but I used them once or twice just for fun in Bitwarden and now I can't find them anywhere in my vault. https://community.bitwarden.com/t/special-vault-search-keyword-for-entries-with-passkeys/62187 https://community.bitwarden.com/t/special-vault-search-keywo... Maybe it's just a Bitwarden issue. The 2FA issue isn't such for me. As I explained in a different comment, 2FA pins are copied automatically and are thus just a "ctrl+v" away.
  - nusl 1y ago
    Perhaps a Bitwarden issue. I had them in 1Password and used them without any problems, then moved them out and into my Apple Keychain to separate those concerns a bit better. Both solutions work pretty well. Having to pull my phone out or go and find/fetch it to grab a pin is pretty annoying for me, since I also don't keep them in my password manager. I did for a long time but figured that if my password manager was compromised I would be royally screwed since they'd have my 2FA there to, meaning the password manager is actually a weak point.

ellisv 1y ago

Yes/no. I have a few passkeys in my vault but several are for different accounts with the same company (e.g. Amazon, Google). I expect adoption to continue but will take years.