Hacker News Reader

Comment by thayne | Hacker News Reader

But companies like Google, Microsoft, and Apple have a vested interest in making third party tools like bitwarden not work as well, or not at all on their platforms.

View on HN

iOS and Android both have APIs for plugging in custom password managers into password entry fields in every app, and for using passkeys with those custom password managers. I use 1password on my iPhone and my Android and it integrates perfectly with both. I agree that those corporations have an interest in making those tools work poorly to stop you from leaving the platform, but they seem to have done the right thing and put some effort into allowing them to work well.

Microsoft has been actively working on a new API to make third-party password managers natively integrate with Windows:

https://learn.microsoft.com/en-us/windows/apps/develop/secur... https://blogs.windows.com/windows-insider/2025/06/27/announc...

Bitwarden works just as well on Android. In fact, it's even easier when it comes to managing multiple passkeys per domain. And yes, that includes CTAP2 logins ("scan a QR code with your phone to log in").

From what I saw, 1Password was fighting tooth and nail to get into the FIDO Alliance, as the big corps were trying to leave 3rd party password managers behind. I assume without fights like this, all 3rd party password managers would have been left behind. I think that was the plan, thankfully it didn’t work.

Keepass was straight up threatened with blackballing using the attestation feature an enforcement mechanism. This thing was barely out of the gate before the mask slipped.

For now. But will that always be the case? And what if sites use attestation to reject passkeys from providers loke bitwarden or keepass(xc)?

iOS third-party password manager integration has gotten better over the years. It went from nonexistent, to half-working but constantly pushing me to use iCloud passwords instead, to allowing third-party to be the default once I set it up and never mentioning iCloud passwords to me during normal use.

If blocking this integration will ever be in their interest (I can't say much about this though), then they'll just tighten the grip as soon as passkeys are the norm and other auth methods are deprecated. It's always easy to invoke generic or obscure "security" reasons, even if it means creating the problems themselves so they come with the solution just in time.

Passkeys with 1Password on iOS is excellent

Reply on news.ycombinator.com