5 ms·

If I can't export the private key to my own backup solution, I don't want it.

by djrj477dhsnv 1y ago

Analemma_ 1y ago
[flagged]
- ChromaticPanic 1y ago
  If that means I lose access to my accounts if my device dies on me, then hard pass.
- CamperBob2 1y ago
  Sounds like the sort of thing that will lock me out for any of a dozen different reasons.
  - subarctic 1y ago
    Ya really what you want is your passwords saved in an encrypted vault that you can copy from device to device for backup. If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services to create a new passkey for the new device, that sounds terrible
    - WarOnPrivacy 1y ago
      > If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services .... I'm typing this on my Firefox remote app. Everything is cached in it. It runs in a VM at home. I suppose I am simulating having just one device.
      - Brian_K_White 1y ago
        Everyone else: don't do this
        stoltzmann 1y ago
        Why not? It actually sounds like the best way to use passkeys and still have control over them.
        WarOnPrivacy 1y ago
        I've been super happy with it. My logins are always with me but they never leave the house. > It actually sounds like the best way to use passkeys and still have control over them. I belatedly recall that I tried to setup a Google passkey in a VM and was rebuffed. Google depends on Windows Hello for passkey presentation prompts - and Hello is disabled in an RDP session (ostensibly because facial rec won't be needed). I poked at the problem for a while and couldn't find a workaround.
        WarOnPrivacy 1y ago
        It's a safe, simple and secure config. I understand that's not for everyone.
        Brian_K_White 1y ago
        It's simple and convenient, it may or may not be secure, it is not safe, it's fragile. I understand avoiding unnecessary single points of failure is not for everyone.
        WarOnPrivacy 1y ago
        > it may or may not be secure It is secure. > it is not safe, This is incorrect. > it's fragile This is incorrect. Many thousands of sessions over most of a decade all testify to to it's robustness and reliability. > I understand avoiding unnecessary single points of failure is not for everyone. That's an interesting segue.
- AlotOfReading 1y ago
  And yet people still need to share authentications between different devices (or people) and back them up for recovery purposes. If you're expecting only what you're saying, you'll find yourself simultaneously disappointed at how low the uptake is in the real world and how many major implementations (e.g. Apple) have a vastly different security model.
  - WarOnPrivacy 1y ago
    > And yet people still need to share authentications between different devices (or people) Absolutely. The problem with narrowly targeted security measures is they are a poor fit for nearly everything.
- recursive 1y ago
  What passkeys are isn't something that most people want. I prefer passwords precisely because passkeys have achieved their design objectives. They are just not objectives that I share.
- cyberax 1y ago
  > The whole point of passkeys is that they are a) one per device and b) stored on the device's secure enclave This is literally the opposite of what Passkeys are.
- hulitu 1y ago
  > The whole point of passkeys is that they are a) one per device Hm, so then i need one for my account and one for every device where i use this account > and b) stored on the device's secure enclave, where in theory you're never supposed to be able to export/exfiltrate them, only validate them i heard that the new "device's secure enclave" is the cloud.
  - charcircuit 1y ago
    One per device you want to authenticate with. So for example you can use your phone to do the authentication for many other devices you own.
    - porridgeraisin 1y ago
      And if I want to share the credentials with my parents who I may not always be available to?
      - charcircuit 1y ago
        You can either share your passkey physically, or you can add one of their passkeys to your account.
    - hulitu 1y ago
      > So for example you can use your phone to do the authentication for many other devices you own. No batery, no authentication. Why do i need an additional device ? A device controlled by another vendor.
    - cyberax 1y ago
      The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. The WebAuthn _also_ allows device-bound keys, but they are not "passkeys".
      - recursive 1y ago
        > The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. That seems to be counter to everything else I've heard about it so far. If that was the case, exporting would be easy, yet many password managers have had open feature requests for some time (1y+?). I don't know what the truth is, but if you're right, there's definitely a lot of misinformation about it. Far more than correct info IME.
- comex 1y ago
  No, passkey export is intended to be a thing and is becoming a thing. I'm not sure if Microsoft has implemented it yet but here is Apple's version: https://mobileidworld.com/apple-introduces-cross-platform-passkey-import-export-features-across-operating-systems/ https://mobileidworld.com/apple-introduces-cross-platform-pa...
- freeone3000 1y ago
  Someone should tell Apple; they’ve been cloud-syncing passkeys for years.
- whatevaa 1y ago
  No, their point is that they are absurdly long and not phishable. Point b is not practical for mass uptake, as hardware devices get broken/lost/stolen all thr time. And no, only nerds will have multiple ones.
akho 1y ago
Password managers sync passkeys just fine. If you use one of those, the benefit of passkeys is that some sites skip their SMS 2fa if you use a passkey. The downside is that you can only use them from your own devices, where you have the app/extension.
- jeroenhd 1y ago
  I don't think skipping 2FA is a benefit. Sure, replace SMS with passkeys or TOTP or literally anything else, but don't actually take away my second factor, please!
  - izacus 1y ago
    Having to pointlessly copy aroudn TOTPs from the same device is just security theater. There's no meaningful security difference for 2FA whether you actually need to copy around those tokens or if you click "authenticate with the key in app on my second factor device". It's still 2 factors. Just with less hassle (and resulting in more security due to better UX).
  - akho 1y ago
    Skipping SMS is an obvious benefit. Your passkey management system can embed as many factors as you want.
    - burnt-resistor 1y ago
      Placing a bunch of factors into 1 system is a giant SPoF like storing TOTPs with corresponding passwords within the same password manager. It defeats the whole purpose of 2+FA.
- burnt-resistor 1y ago
  > Password managers sync passkeys 0. Which Password manager(s)? > just fine 1. Sync where and with whom? 2. And are you including or excluding export and/or import too? You provide no evidence for your claims. PKs are being used as 1 factor mechanisms. That's centralizing a whole lot of trust.

If I can't export the private key to my own backup solution, I don't want it.

Analemma_ 1y ago

[flagged]

ChromaticPanic 1y ago
If that means I lose access to my accounts if my device dies on me, then hard pass.
CamperBob2 1y ago
Sounds like the sort of thing that will lock me out for any of a dozen different reasons.
- subarctic 1y ago
  Ya really what you want is your passwords saved in an encrypted vault that you can copy from device to device for backup. If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services to create a new passkey for the new device, that sounds terrible
  - WarOnPrivacy 1y ago
    > If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services .... I'm typing this on my Firefox remote app. Everything is cached in it. It runs in a VM at home. I suppose I am simulating having just one device.
    - Brian_K_White 1y ago
      Everyone else: don't do this
      - stoltzmann 1y ago
        Why not? It actually sounds like the best way to use passkeys and still have control over them.
        WarOnPrivacy 1y ago
        I've been super happy with it. My logins are always with me but they never leave the house. > It actually sounds like the best way to use passkeys and still have control over them. I belatedly recall that I tried to setup a Google passkey in a VM and was rebuffed. Google depends on Windows Hello for passkey presentation prompts - and Hello is disabled in an RDP session (ostensibly because facial rec won't be needed). I poked at the problem for a while and couldn't find a workaround.
      - WarOnPrivacy 1y ago
        It's a safe, simple and secure config. I understand that's not for everyone.
        Brian_K_White 1y ago
        It's simple and convenient, it may or may not be secure, it is not safe, it's fragile. I understand avoiding unnecessary single points of failure is not for everyone.
        WarOnPrivacy 1y ago
        > it may or may not be secure It is secure. > it is not safe, This is incorrect. > it's fragile This is incorrect. Many thousands of sessions over most of a decade all testify to to it's robustness and reliability. > I understand avoiding unnecessary single points of failure is not for everyone. That's an interesting segue.
AlotOfReading 1y ago
And yet people still need to share authentications between different devices (or people) and back them up for recovery purposes. If you're expecting only what you're saying, you'll find yourself simultaneously disappointed at how low the uptake is in the real world and how many major implementations (e.g. Apple) have a vastly different security model.
- WarOnPrivacy 1y ago
  > And yet people still need to share authentications between different devices (or people) Absolutely. The problem with narrowly targeted security measures is they are a poor fit for nearly everything.
recursive 1y ago
What passkeys are isn't something that most people want. I prefer passwords precisely because passkeys have achieved their design objectives. They are just not objectives that I share.
cyberax 1y ago
> The whole point of passkeys is that they are a) one per device and b) stored on the device's secure enclave This is literally the opposite of what Passkeys are.
hulitu 1y ago
> The whole point of passkeys is that they are a) one per device Hm, so then i need one for my account and one for every device where i use this account > and b) stored on the device's secure enclave, where in theory you're never supposed to be able to export/exfiltrate them, only validate them i heard that the new "device's secure enclave" is the cloud.
- charcircuit 1y ago
  One per device you want to authenticate with. So for example you can use your phone to do the authentication for many other devices you own.
  - porridgeraisin 1y ago
    And if I want to share the credentials with my parents who I may not always be available to?
    - charcircuit 1y ago
      You can either share your passkey physically, or you can add one of their passkeys to your account.
  - hulitu 1y ago
    > So for example you can use your phone to do the authentication for many other devices you own. No batery, no authentication. Why do i need an additional device ? A device controlled by another vendor.
  - cyberax 1y ago
    The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. The WebAuthn _also_ allows device-bound keys, but they are not "passkeys".
    - recursive 1y ago
      > The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. That seems to be counter to everything else I've heard about it so far. If that was the case, exporting would be easy, yet many password managers have had open feature requests for some time (1y+?). I don't know what the truth is, but if you're right, there's definitely a lot of misinformation about it. Far more than correct info IME.
comex 1y ago
No, passkey export is intended to be a thing and is becoming a thing. I'm not sure if Microsoft has implemented it yet but here is Apple's version: https://mobileidworld.com/apple-introduces-cross-platform-passkey-import-export-features-across-operating-systems/ https://mobileidworld.com/apple-introduces-cross-platform-pa...
freeone3000 1y ago
Someone should tell Apple; they’ve been cloud-syncing passkeys for years.
whatevaa 1y ago
No, their point is that they are absurdly long and not phishable. Point b is not practical for mass uptake, as hardware devices get broken/lost/stolen all thr time. And no, only nerds will have multiple ones.

akho 1y ago

Password managers sync passkeys just fine. If you use one of those, the benefit of passkeys is that some sites skip their SMS 2fa if you use a passkey. The downside is that you can only use them from your own devices, where you have the app/extension.

jeroenhd 1y ago
I don't think skipping 2FA is a benefit. Sure, replace SMS with passkeys or TOTP or literally anything else, but don't actually take away my second factor, please!
- izacus 1y ago
  Having to pointlessly copy aroudn TOTPs from the same device is just security theater. There's no meaningful security difference for 2FA whether you actually need to copy around those tokens or if you click "authenticate with the key in app on my second factor device". It's still 2 factors. Just with less hassle (and resulting in more security due to better UX).
- akho 1y ago
  Skipping SMS is an obvious benefit. Your passkey management system can embed as many factors as you want.
  - burnt-resistor 1y ago
    Placing a bunch of factors into 1 system is a giant SPoF like storing TOTPs with corresponding passwords within the same password manager. It defeats the whole purpose of 2+FA.
burnt-resistor 1y ago
> Password managers sync passkeys 0. Which Password manager(s)? > just fine 1. Sync where and with whom? 2. And are you including or excluding export and/or import too? You provide no evidence for your claims. PKs are being used as 1 factor mechanisms. That's centralizing a whole lot of trust.