I still don’t understand why anyone who isn’t in the walled garden business would consent to passkeys.
My GitHub account currently has a 1Password passkey and an Apple passkey. IIRC I added the Apple-generated passkey before 1Password supported them, but both work, and neither prevents me from moving to a different pass* manager in the future.
I personally feel safer that passkeys aren't sync'd across multiple vendors' products.
https://www.yubico.com/resources/glossary/what-is-a-passkey/
Last time I checked into these hardware attestation was part of the specification but the ability export them from a vendors platforms is not. In practice that will mean unapproved platforms can be shut out and walled gardens strengthened. Which will happen sooner or later because it can. Apple supposedly zeroes their attestation but that is only a partial mitigation and relies upon the values of a giant corporation not changing its mind for any host of business reasons. And it does nothing to stop other platforms.
I believe it's there to support the use case of companies who want to ensure their employees are using company-approved devices and methods to interact with company systems.
It's a reasonable use case.
Security keyfob vendors have had attestations for years because they were selling primarily to corporate markets who have closed user bases and stringent authentication requirements, with some also provided to early adopter consumers.
Platforms and password managers are targeting consumer use cases, where preventing the user from leveraging the product would be a terrible thing, as would the 'user agent' problem where later entrants to the market have to beg to be on every site's allow list or lie and claim to be another product.
The synchronization doesn't break attestations. The idea of sites rejecting authenticators that synchronize means that attestations have become an anti-feature in the consumer space.
For me, it's precisely because I know I don't understand how they work.
With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing.
With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. The test for me is whether I can copy some piece of data out of the password manager and use it to authenticate. If authentication has to "go through" the manager, then my access to my account is vulnerable to the whims of the password manager. Or perhaps the whims of the new corporate owners of the password manager.
I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys.
I'll be holding out either until I can understand satisfactory answers to these, or until support for passwords gets dropped from services I use.
I'm still strongly in favor of passkeys overall, though. They don't need to be used for every service, but strong, safe, phish-proof asymmetric crypto being used for user auth just makes sense.
Fair enough! It still seems a bit like magic when it works.
> With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts.
I'm not sure how a pass[word|key] manager would lock you out of your accounts, but if you don't use password managers for that reason, that same theoretical danger would be true of passkey managers.
I don't personally have any of my extremely secure auto-created passwords memorized either, so for me a passkey is not different in that respect. If I inadvertently delete a pass[word|key], I'll have to go through the "forgot my password" process.
Within 5 years, I can imagine services without password support. I'd expect that in "lost passkey" cases, those services will support allowing you to log in with a one-time code sent to your registered email address (or SMS) and/or with backup codes.
> I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys.
Here's a real-world example: I played with Apple's passkey support before 1Password's passkey support was available. When 1Password added passkey support, I added another passkey to the sites that supported it and called it "1Password".
And here's what it looks like when your Google account has 3 passkeys: https://imgur.com/a/NQl8XPI
Your password manager acts as the middleware between the keys and the software you need to authenticate with. You just need it to speak to services that use passkeys, and you can swap it out for anything that is able to do the same.
Your "password manager" in this case can also just be a physical security key.
It's entirely possible to use passkeys outside of either platform by using any FIDO2 security key with discoverable key storage. There are even existing open source apps that emulate FIDO2 security keys that you can use.
I also believe that passkeys can be backed up and exported on Android/iOS, either now or sometime in the future.
The FIDO Alliance is working on standardizing the backup and transfer of passkeys so that they can be exported and used however you see fit.
That said, I don't use the Android or iOS implementation of passkeys and probably never will. It's possible to use passkeys without ever giving closed platforms the keys to your castle.
Though last I checked no browser had created an API for extensions to implement the passkey API. KeepassXC's implementation for example has to inject JS into every page to override `window.navigator.credentials` ( https://github.com/keepassxreboot/keepassxc-browser/pull/178... ). It works but is brittle, so a proper way through extension API would be nice.
For reference, I just 5 minutes ago opened GitHub in Edge on my iOS device, clicked "Sign in with Passkey", and 1Password correctly popped up and offered to sign in with the passkey I had created in Edge on my desktop. I then opened Safari on my phone, and did the same thing. So it definitely is getting there.
A pure web extension password/passkey manager currently has to go the injection route, and will not surface credentials in native apps. This generally means that if you use such a manager, you need to make not to select any options to remove your password, either from your password manager or from the account behind that native app.
You can just use a yubikey unless I'm mistaken?
Yes, USB passkeys work!
You could use any FIDO2 software or hardware key with Passkey.