3 ms·

Passkey are more like password managers, and less like MFA tokens - despite the fact that many passkey implementations can function as MFA tokens as well. Bitw

Passkey are more like password managers, and less like MFA tokens - despite the fact that many passkey implementations can function as MFA tokens as well. Bitwarden the password manager includes a full passkey implementation, which doesn't involve any MFA.

valenterry 1y ago
> Passkey are more like password managers, and less like MFA tokens No: - I can always export and import all my passwords from/into my password manager - My passwords always work independently of a password manager or any specific app/OS/hardware That is not true for passkeys and makes them much more like tokens. Of course they don't have to be used in MFA, just like passwords.
- jerf 1y ago
  I just exported my Bitwarden vault and the resulting .json file has my passkeys in it. I'm not going to try to test import, but if it doesn't work that would obviously be more "bug" than anything else. Clearly "export" is the high concern functionality and once exported, importing them is not a big deal. This is only about your first paragraph, it doesn't affect your second.
  - geodel 1y ago
    Indeed. Credential Exchange Protocol (CXP) is already been worked on and all major vendors are planning to support it. There was talk also in Apple WWDC 2025 about Passkey related APIs including exporting them.
  - valenterry 1y ago
    Unfortunately just because it's possible with Bitwarden doesn't mean it is always possible.
    - palata 1y ago
      Are you saying that it's not always possible to import/export passkeys because you can manage them with some program that doesn't allow it, but the same is not true for passkeys? Counter-example: I can write a password manager that will not allow you to export/import passwords.
      - valenterry 1y ago
        No, that's not what I meant. There are cases where bitwarden doesn't work but chrome for example does. Easy to Google up. For passwords however, I never heard of a case where a website only accepts passwords from a specific password manager - and how could they even do that right?
        palata 1y ago
        I don't think your reasoning holds. You say "I know situations where one passkey client works with some websites and not others, but I don't know situations where a website works with some clients and not others". If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it?
        valenterry 1y ago
        > but I don't know situations where a website works with some clients and not others For example: https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselec... > If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it? Unfortunately not...
        palata 1y ago
        > For example: [...] Those sound like requirements similar to those that can be enforced with passwords. My company enforces an SSO system with an MFA scheme that is controlled by the IT department. I can use my password manager for the password part, but I must use the mandatory MFA app. In that sense, I am not sure it is so different from passkeys?

valenterry 1y ago

> Passkey are more like password managers, and less like MFA tokens No: - I can always export and import all my passwords from/into my password manager - My passwords always work independently of a password manager or any specific app/OS/hardware That is not true for passkeys and makes them much more like tokens. Of course they don't have to be used in MFA, just like passwords.

jerf 1y ago
I just exported my Bitwarden vault and the resulting .json file has my passkeys in it. I'm not going to try to test import, but if it doesn't work that would obviously be more "bug" than anything else. Clearly "export" is the high concern functionality and once exported, importing them is not a big deal. This is only about your first paragraph, it doesn't affect your second.
- geodel 1y ago
  Indeed. Credential Exchange Protocol (CXP) is already been worked on and all major vendors are planning to support it. There was talk also in Apple WWDC 2025 about Passkey related APIs including exporting them.
- valenterry 1y ago
  Unfortunately just because it's possible with Bitwarden doesn't mean it is always possible.
  - palata 1y ago
    Are you saying that it's not always possible to import/export passkeys because you can manage them with some program that doesn't allow it, but the same is not true for passkeys? Counter-example: I can write a password manager that will not allow you to export/import passwords.
    - valenterry 1y ago
      No, that's not what I meant. There are cases where bitwarden doesn't work but chrome for example does. Easy to Google up. For passwords however, I never heard of a case where a website only accepts passwords from a specific password manager - and how could they even do that right?
      - palata 1y ago
        I don't think your reasoning holds. You say "I know situations where one passkey client works with some websites and not others, but I don't know situations where a website works with some clients and not others". If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it?
        valenterry 1y ago
        > but I don't know situations where a website works with some clients and not others For example: https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselec... > If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it? Unfortunately not...
        palata 1y ago
        > For example: [...] Those sound like requirements similar to those that can be enforced with passwords. My company enforces an SSO system with an MFA scheme that is controlled by the IT department. I can use my password manager for the password part, but I must use the mandatory MFA app. In that sense, I am not sure it is so different from passkeys?