5 ms·

Well, I'm talking about definition of the spec and principle here. If they start dictating impossibility of looking at your own private keys by design of the sp

by shmerl 1y ago

Well, I'm talking about definition of the spec and principle here. If they start dictating impossibility of looking at your own private keys by design of the spec, it should be strongly pushed back against. There is enough of abuse in taking away control from the user with all kind of opaque stuff. And what you can do or want to do with your private key is really up to you. Copy it and import into another password manager could be a reasonable use case, besides simple curiosity. Basically, slapping on it some kind of DRM-like restrictions in the name of security isn't right. You can make it non trivial to make it more clear that it has risks, but not prevent users from accessing it if they insist.

Gigachad 1y ago
So there is a portability spec in progress for copying your passkeys between password managers, it's just seemingly not ready yet. You can also use KeepassX which lets you export the keys in plain text which would be the power user option. Passkeys as a tech doesn't stop you doing this, only the mainstream Passkey managers.
- shmerl 1y ago
  keepassxc is good, yeah. The point I'm making is that it shouldn't become mandatory to always force this DRM stuff. So far it didn't happen, but it always can.
- mzajc 1y ago
  KeepassXC is great, until the Passkey mafia starts actively blocking its use: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954 https://github.com/keepassxreboot/keepassxc/issues/10407#iss... > I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations). Or in less patronizing terms: "do what we want or we're blacklisting you."
  - timmyc123 1y ago
    who exactly is "we" in this context?

by shmerl 1y ago

Gigachad 1y ago

So there is a portability spec in progress for copying your passkeys between password managers, it's just seemingly not ready yet. You can also use KeepassX which lets you export the keys in plain text which would be the power user option. Passkeys as a tech doesn't stop you doing this, only the mainstream Passkey managers.

shmerl 1y ago
keepassxc is good, yeah. The point I'm making is that it shouldn't become mandatory to always force this DRM stuff. So far it didn't happen, but it always can.
mzajc 1y ago
KeepassXC is great, until the Passkey mafia starts actively blocking its use: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954 https://github.com/keepassxreboot/keepassxc/issues/10407#iss... > I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations). Or in less patronizing terms: "do what we want or we're blacklisting you."
- timmyc123 1y ago
  who exactly is "we" in this context?