3 ms·

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being t

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

vincnetas 1mo ago
I think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.
- gonzalohm 1mo ago
  I think you can but it has to be supported by the website that you are using
cassianoleal 1mo ago
I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.
- gonzalohm 1mo ago
  Doesn't that defeat the purpose? I thought the objective was to get rid of passwords
- ChrisMarshallNY 1mo ago
  I use passkeys only, for the backend admin app for my app. They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else. Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch. I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password. A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/ https://littlegreenviper.com/series/passkeys/
jerf 1mo ago
My passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them. It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though. Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.
- esseph 1mo ago
  This sounds like a Bitwarden specific issue, because I don't have that problem with Proton.
  - jerf 1mo ago
    More poking around suggests it is an Android 14 issue.
jeroenhd 1mo ago
Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden). Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default. As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.
- iamnothere 1mo ago
  There are even open source hardware passkeys (NitroKey) so you can have security with freedom.
- FireBeyond 1mo ago
  > Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default. Assuming the FIDO Consortium approves. Otherwise you might be like KeePass, being unceremoniously threatened with revocation of attestation, for offering to do what the big players are able to do.
giancarlostoro 1mo ago
My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it. When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.
- krrrh 1mo ago
  Bluetooth is actually only used to establish proximity. Both your phone and the browser connect to an internet relay, which lets the phone essentially pretend to be a USB security key connected to the computer.
duskdozer 1mo ago
You can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.
ExoticPearTree 1mo ago
> think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account) It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devices. There are cases though, where the website can force the requirement of a device bound passkey, but that is something it is not very likely you will encounter.
- gonzalohm 1mo ago
  But you don't own your passkey. That's the biggest red flag. It's yet another wall by apple to prevent you from leaving their ecosystem
  - ChrisMarshallNY 1mo ago
    I think the OS is needed to sign the challenge, but the private key can be taken wherever. And passkeys are multiplatform. Not Apple-only, by a long shot. And I suspect that most geeks, hereabouts, could set up their own signing system.
- vablings 1mo ago
  I have considered making a website that specifically enforces the use of a hardware passkey such as a yubikey since you can verify that it it is a real device signed by yubico meaning that if you want a bunch of users to come discuss a subject they are verified by means of having to purchase a physical key. Obviously, there is nothing stopping someone from buying a bunch of yubikeys but you can then ban said users with those yubikeys

vincnetas 1mo ago

I think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.

gonzalohm 1mo ago
I think you can but it has to be supported by the website that you are using

cassianoleal 1mo ago

I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.

gonzalohm 1mo ago
Doesn't that defeat the purpose? I thought the objective was to get rid of passwords
ChrisMarshallNY 1mo ago
I use passkeys only, for the backend admin app for my app. They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else. Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch. I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password. A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/ https://littlegreenviper.com/series/passkeys/

jerf 1mo ago

My passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them. It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though. Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.

esseph 1mo ago
This sounds like a Bitwarden specific issue, because I don't have that problem with Proton.
- jerf 1mo ago
  More poking around suggests it is an Android 14 issue.

jeroenhd 1mo ago

Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden). Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default. As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.

iamnothere 1mo ago
There are even open source hardware passkeys (NitroKey) so you can have security with freedom.
FireBeyond 1mo ago
> Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default. Assuming the FIDO Consortium approves. Otherwise you might be like KeePass, being unceremoniously threatened with revocation of attestation, for offering to do what the big players are able to do.

giancarlostoro 1mo ago

My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it. When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.

krrrh 1mo ago
Bluetooth is actually only used to establish proximity. Both your phone and the browser connect to an internet relay, which lets the phone essentially pretend to be a USB security key connected to the computer.

duskdozer 1mo ago

You can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.

ExoticPearTree 1mo ago

> think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account) It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devices. There are cases though, where the website can force the requirement of a device bound passkey, but that is something it is not very likely you will encounter.

gonzalohm 1mo ago
But you don't own your passkey. That's the biggest red flag. It's yet another wall by apple to prevent you from leaving their ecosystem
- ChrisMarshallNY 1mo ago
  I think the OS is needed to sign the challenge, but the private key can be taken wherever. And passkeys are multiplatform. Not Apple-only, by a long shot. And I suspect that most geeks, hereabouts, could set up their own signing system.
vablings 1mo ago
I have considered making a website that specifically enforces the use of a hardware passkey such as a yubikey since you can verify that it it is a real device signed by yubico meaning that if you want a bunch of users to come discuss a subject they are verified by means of having to purchase a physical key. Obviously, there is nothing stopping someone from buying a bunch of yubikeys but you can then ban said users with those yubikeys