3 ms·

> The whole point of passkeys is that they are a) one per device Hm, so then i need one for my account and one for every device where i use this account > and

by hulitu 1y ago

> The whole point of passkeys is that they are a) one per device Hm, so then i need one for my account and one for every device where i use this account > and b) stored on the device's secure enclave, where in theory you're never supposed to be able to export/exfiltrate them, only validate them i heard that the new "device's secure enclave" is the cloud.

charcircuit 1y ago
One per device you want to authenticate with. So for example you can use your phone to do the authentication for many other devices you own.
- porridgeraisin 1y ago
  And if I want to share the credentials with my parents who I may not always be available to?
  - charcircuit 1y ago
    You can either share your passkey physically, or you can add one of their passkeys to your account.
- hulitu 1y ago
  > So for example you can use your phone to do the authentication for many other devices you own. No batery, no authentication. Why do i need an additional device ? A device controlled by another vendor.
- cyberax 1y ago
  The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. The WebAuthn _also_ allows device-bound keys, but they are not "passkeys".
  - recursive 1y ago
    > The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. That seems to be counter to everything else I've heard about it so far. If that was the case, exporting would be easy, yet many password managers have had open feature requests for some time (1y+?). I don't know what the truth is, but if you're right, there's definitely a lot of misinformation about it. Far more than correct info IME.
    - cyberax 1y ago
      You can export passkeys from Apple and MS keyrings just fine. BitWarden and 1Pass also support exporting and cross-device syncing. What is missing is the standardized interchange format for exported passkeys.
      - recursive 1y ago
        There are or were some people pretty deep into the scene who didn't believe this was supposed to be the case. For example, https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407
        cyberax 1y ago
        Migration protocols require the keys to be representable (at some point) as clear text. And password managers like BitWarden only allow encrypted export, but the encryption key is specified by the user. So you can trivially decrypt the exported data if you want.
        recursive 1y ago
        I don't have a dog in this race. Just showing where the other understandings come from. Your logic might lead one to conclude that migration would not then generally be available.
  - WarOnPrivacy 1y ago

by hulitu 1y ago

charcircuit 1y ago

One per device you want to authenticate with. So for example you can use your phone to do the authentication for many other devices you own.

porridgeraisin 1y ago
And if I want to share the credentials with my parents who I may not always be available to?
- charcircuit 1y ago
  You can either share your passkey physically, or you can add one of their passkeys to your account.
hulitu 1y ago
> So for example you can use your phone to do the authentication for many other devices you own. No batery, no authentication. Why do i need an additional device ? A device controlled by another vendor.
cyberax 1y ago
The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. The WebAuthn _also_ allows device-bound keys, but they are not "passkeys".
- recursive 1y ago
  > The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced. That seems to be counter to everything else I've heard about it so far. If that was the case, exporting would be easy, yet many password managers have had open feature requests for some time (1y+?). I don't know what the truth is, but if you're right, there's definitely a lot of misinformation about it. Far more than correct info IME.
  - cyberax 1y ago
    You can export passkeys from Apple and MS keyrings just fine. BitWarden and 1Pass also support exporting and cross-device syncing. What is missing is the standardized interchange format for exported passkeys.
    - recursive 1y ago
      There are or were some people pretty deep into the scene who didn't believe this was supposed to be the case. For example, https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407
      - cyberax 1y ago
        Migration protocols require the keys to be representable (at some point) as clear text. And password managers like BitWarden only allow encrypted export, but the encryption key is specified by the user. So you can trivially decrypt the exported data if you want.
        recursive 1y ago
        I don't have a dog in this race. Just showing where the other understandings come from. Your logic might lead one to conclude that migration would not then generally be available.
- WarOnPrivacy 1y ago