timmyc123

5 ms·

31.
by timmyc123 10mo ago
when you create or use a passkey, the UI on all platforms tells you where it is going to be saved or where it is coming from.
32.
by timmyc123 10mo ago
This is not correct. The default credential manager on all devices except for Windows, creates synced passkeys. And Windows will be changing soon.
33.
by timmyc123 10mo ago
This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to somethin
34.
by timmyc123 1y ago
I'd say: 1) That would be a whole lot of work, collusion, etc for a very limited scope and outcome, which makes it incredibly unlikely to happen in practice. 2) If a credential manager decides to do shady things that you don't li
35.
by timmyc123 1y ago
> Until we have full E2E passkey implementations that are completely untethered from the major players, where you can do passkey auth with 3 raspberry pi's networked together and no broader internet connection This is already possib
36.
by timmyc123 1y ago
Just because an API or protocol has a certain capability, does not mean it is implemented for all use cases. Folks seem to be hung up on the term "attestation" being in the response of a create call. If you look inside that object
37.
by timmyc123 1y ago
Ecosystems are made up of hundreds of thousands of organizations, billions of devices,and billions of users. How do you expect a single person to be able to make an authoritative statement like that?
38.
by timmyc123 1y ago
You should really re-read the entire discussion. It wasn't about passkeys being able to be exported. It was specifically about clear text export. > The fact that that possibility exists, The possibility does not exist in the consume
39.
by timmyc123 1y ago
Bitwarden is a great option for you. You can even self host it!
40.
by timmyc123 1y ago
Since you keep posting this link, I'll just keep saying it: there is no credential manager attestation in the consumer synced passkey ecosystem. Period. There is no way to build and allowlist, by design. The consumer synced passkey eco
41.
by timmyc123 1y ago
> You can't do any of that with passkeys. Device-bound passkeys which are used in workforce / enterprise scenarios are typically attested. Attestation does not exist for consumer synced passkeys by design. It is an open ecosyst
42.
by timmyc123 1y ago
There is no credential manager attestation in the consumer synced passkey ecosystem. Period.
43.
by timmyc123 1y ago
> Passkeys will be the way to go if we get them to remove the "attestation object" field from the protocol. I don't think you understand the protocol. The attestation object does not mean there is an authenticator attestat
44.
by timmyc123 1y ago
> I am waiting for the era when using passkeys is not depending from some big tech company. You can choose any credential manager you want to store your passkeys.
45.
by timmyc123 1y ago
> The issue at hand is the requirement for client attestation while using passkeys. There is no attestation in the consumer synced passkey ecosystem. Period.
46.
by timmyc123 1y ago
Hi, since you mentioned me, that's not what was said and putting it in quotes as if I did is really inappropriate. I'll post the same response I replied to other on a different thread: Wild that you (and a few others) continue to
47.
by timmyc123 1y ago
> Please note that there are 2 types of passkeys This is not really correct. Non-resident keys are not passkeys. The two types of passkeys are synced and device-bound. Synced passkeys are typically stored in software-based credential man
48.
by timmyc123 1y ago
how do you figure? It is a completely open ecosystem. You can choose whichever credential manager you want.
49.
by timmyc123 1y ago
> How is it "completely, absolutely impractical outside of a closed org" when I thought Google attests every passkey created on Android? Passkeys in Google Password Manager are not attested. There is no known synced passkey cre
50.
by timmyc123 1y ago
> I don't like getting locked in to one password manager. You can choose any credential manager you like, including those like Bitwarden who give you full control of your data.
51.
by timmyc123 1y ago
who exactly is "we" in this context?
52.
by timmyc123 1y ago
> one of the FIDO devs immediately threatened to do to keepass Wild that you (and a few others) continue to make these accusations about me in these comments (and in other venues). 1) I've been one of the most vocal proponents of sy
53.
by timmyc123 1y ago
> How would I "move" the passkeys, as they'd still be tied to the old domain? You can also use a combination of Related Origin Requests[1], Conditional Create, and Signal API to allow the passkey for the old site to be use
54.
by timmyc123 1y ago
> Why would I use a TPM to store a shared secret? There is no shared secret. A passkey is a public/private key pair.
55.
by timmyc123 1y ago
This is correct. There are two types of passkeys: device-bound and synced. You can choose whichever credential manager/authenticator that supports your needs. https://passkeys.dev/docs/reference/terms/#sy
56.
by timmyc123 1y ago
This is exactly what exists today. There is no "CA-style provider certification" in the synced passkey ecosystem. It is completely open.
57.
by timmyc123 3y ago
Nearly all work to support passkeys is via the WebAuthn specification, which is developed entirely in public via a GitHub repo ( https://github.com/w3c/webauthn ). Passkeys aren't a standard or protocol. A passkey i
58.
by timmyc123 3y ago
>> "Frankly, I'm done with the "wait and see" approach to the FIDO alliances constant foot-dragging on portability and their continuous indication through their actions that they do not see portability as a user re
59.
by timmyc123 5y ago
Sweetgreen is using a PWA on Android, installed via the Play Store.
60.
by timmyc123 6y ago
I use SSH Config app on Mac (included with SetApp) for managing config. I also use 'Secure Agent' which generates the private key in the hardware secure element with unlocking via biometric (with fallback to password). https:&#x2

More ›