3 ms·

Exporting passkeys is the single required feature for me to start using them more. The "anti phishing" push has really gotten a little too crazy. It seems mo

by seany 1y ago

Exporting passkeys is the single required feature for me to start using them more. The "anti phishing" push has really gotten a little too crazy. It seems mostly related to our legal inability to push security responsibility onto consumers.

EbNar 1y ago
>Exporting passkeys is the single required feature for me to start using them more. Ditto
jazzyjackson 1y ago
Given that you don't strictly need to have one passkey per site, is this desire to move passkeys around a holdover from wanting to "export" your passwords? Because if you can export them, an exploit can too. I find passkeys rather more interesting when they cannot be exported from a HSM / key enclave / yubikey, but of course I need to be able to register multiple yubikeys per site, and a few of my accounts didn't allow for this so I ended up using my yubikey for TOTP since I can have the same seed on multiple devices.
- tuckerman 1y ago
  Export is a good check against lock in. I just went through my password manager and I have 60 passkeys. It would be a huge pain if I have to switch to a different password manager and there isn't export/import.
- recursive 1y ago
  You should be allowed to keep your passkeys in such enclave. But there seems to be no alternative. I'm in the same boat as the GP. I'm not touching passkeys unless and until I can export them into a file I can get my grubby hands on. I'm guessing that's never happening. Not sure what one-passkey-per-site has to do with it.
- mgulick 1y ago
  My keepass database has around 400 different entries in it. If I needed to transfer to a new password manager, it's not feasible to go around to 400 different sites to register new passkeys. In case one might say the answer to that is oauth, I'm also not interested in putting my faith in Google/Microsoft/Apple being benevolent arbiters of my ability to access my accounts.
  - apitman 1y ago
    You could put your faith in LastLogin: https://lastlogin.net https://lastlogin.net
habinero 1y ago
Nothing to do with legal responsibility and it's not about only consumers. I have 50 terabytes of data breaches on a NAS with lots of plain text or badly encrypted passwords, and that's just a small subset of what's out there.
palata 1y ago
There are two kinds of passkeys: the ones you can sync (i.e. export) and the ones you can't. The ones you can't sync are typically security keys, and there it's a feature. So yeah, you can have whichever you want, nothing prevents it!

by seany 1y ago

EbNar 1y ago

>Exporting passkeys is the single required feature for me to start using them more. Ditto

jazzyjackson 1y ago

Given that you don't strictly need to have one passkey per site, is this desire to move passkeys around a holdover from wanting to "export" your passwords? Because if you can export them, an exploit can too. I find passkeys rather more interesting when they cannot be exported from a HSM / key enclave / yubikey, but of course I need to be able to register multiple yubikeys per site, and a few of my accounts didn't allow for this so I ended up using my yubikey for TOTP since I can have the same seed on multiple devices.

tuckerman 1y ago
Export is a good check against lock in. I just went through my password manager and I have 60 passkeys. It would be a huge pain if I have to switch to a different password manager and there isn't export/import.
recursive 1y ago
You should be allowed to keep your passkeys in such enclave. But there seems to be no alternative. I'm in the same boat as the GP. I'm not touching passkeys unless and until I can export them into a file I can get my grubby hands on. I'm guessing that's never happening. Not sure what one-passkey-per-site has to do with it.
mgulick 1y ago
My keepass database has around 400 different entries in it. If I needed to transfer to a new password manager, it's not feasible to go around to 400 different sites to register new passkeys. In case one might say the answer to that is oauth, I'm also not interested in putting my faith in Google/Microsoft/Apple being benevolent arbiters of my ability to access my accounts.
- apitman 1y ago
  You could put your faith in LastLogin: https://lastlogin.net https://lastlogin.net

habinero 1y ago

Nothing to do with legal responsibility and it's not about only consumers. I have 50 terabytes of data breaches on a NAS with lots of plain text or badly encrypted passwords, and that's just a small subset of what's out there.

palata 1y ago

There are two kinds of passkeys: the ones you can sync (i.e. export) and the ones you can't. The ones you can't sync are typically security keys, and there it's a feature. So yeah, you can have whichever you want, nothing prevents it!