Hacker News Reader

Comment by vanviegen | Hacker News Reader

I think a password manager like bitwarden still meets all of those criteria when it's managing passkeys for you.

But companies like Google, Microsoft, and Apple have a vested interest in making third party tools like bitwarden not work as well, or not at all on their platforms.

iOS and Android both have APIs for plugging in custom password managers into password entry fields in every app, and for using passkeys with those custom password managers. I use 1password on my iPhone and my Android and it integrates perfectly with both. I agree that those corporations have an interest in making those tools work poorly to stop you from leaving the platform, but they seem to have done the right thing and put some effort into allowing them to work well.

iOS third-party password manager integration has gotten better over the years. It went from nonexistent, to half-working but constantly pushing me to use iCloud passwords instead, to allowing third-party to be the default once I set it up and never mentioning iCloud passwords to me during normal use.

If blocking this integration will ever be in their interest (I can't say much about this though), then they'll just tighten the grip as soon as passkeys are the norm and other auth methods are deprecated. It's always easy to invoke generic or obscure "security" reasons, even if it means creating the problems themselves so they come with the solution just in time.

Bitwarden works just as well on Android. In fact, it's even easier when it comes to managing multiple passkeys per domain. And yes, that includes CTAP2 logins ("scan a QR code with your phone to log in").

From what I saw, 1Password was fighting tooth and nail to get into the FIDO Alliance, as the big corps were trying to leave 3rd party password managers behind. I assume without fights like this, all 3rd party password managers would have been left behind. I think that was the plan, thankfully it didn’t work.

Keepass was straight up threatened with blackballing using the attestation feature an enforcement mechanism. This thing was barely out of the gate before the mask slipped.

For now. But will that always be the case? And what if sites use attestation to reject passkeys from providers loke bitwarden or keepass(xc)?

Microsoft has been actively working on a new API to make third-party password managers natively integrate with Windows:

https://learn.microsoft.com/en-us/windows/apps/develop/secur... https://blogs.windows.com/windows-insider/2025/06/27/announc...

Passkeys with 1Password on iOS is excellent

A lot of answers to problems people raise wrt passkeys seem to be “using a good password manager”.

But one of the selling point is that they are supposed to help bog standard users be more secure. How many bog standard users do you see using a good password manager, despite how long we've been suggesting that they do. If they aren't going to use one for passwords they aren't going to use one to smooth the edges of passkeys use.

Reply on news.ycombinator.com