WebAuthn and Passkeys

blog.huicochea.moe

1 point·thebitstick··3 comments

I had originally written this after WWDC 2022, and the incredibly low amount of news coverage shocked me enough into researching first-hand the future of passwordless sign-in that Apple/Google/Microsoft want us all to be in.

Nothing has changed in iOS 16 or macOS 13 since WWDC 2022 to suggest that users will have the ability to export their private keys. Passkeys are still a lock-in feature.

Passkeys was not mentioned during the iPhone 14 Event.

I don't have an Android device with Android 11+ to be able to test this, so if any users are able to test out [WebAuthn](https://webauthn.me/) and check if the created passkey via Google's password/passkey manager allows for exporting, it would really be appreciated.

Perhaps this changes with user backlash once enough websites support WebAuthn, but I doubt it.

I think that once users realize how difficult it is to transfer passkeys between their PC and mobile device, they will just ababdon them. The only risk I see is that passkeys will be synced between Android and Chrome.

I really hope that there will be an API for Passkeys like there is an API for password managers on Android.

Why do you want to export them? If it's because you no longer trust Apple, then you don't want to export them, as these PassKeys use Apple for attestation. You'd want to create new PassKeys with a different attestation provider.

Reply on news.ycombinator.com