Hacker News Reader

Comment by cyberax | Hacker News Reader

> That's not the intention of the relevant standards.[1]

Sigh. IT LITERALLY IS.

The name "passkeys" itself means "exportable keys":

> When a user creates a passkey on any of their devices, it gets synced to all the user’s other devices using the same passkey provider that is also signed into the same user’s account. Thus, passkeys created on one device become available on all devices. > Notably, if the user gets a new device and sets it up with their passkey provider, the user’s passkeys are synced and available for sign-in on the new device.

The resident keys (the ones created by platform-specific TPMs) are not passkeys. And they had been standardized _before_ the passkeys.

View on HN

> Sigh. IT LITERALLY IS.

> The name "passkeys" itself means "exportable keys":

> https://fidoalliance.org/passkeys/

This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked. Nor did I see anything indicating that was a core part of their design from a cursory reading of the page, although I might have missed something. Your quote certainly doesn't imply 'exportable'.

Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended. To quote Tim Cappalli, who's credited on the W3C spec as an editor[1] and maintains passkeys.dev,[2] so presumably knows what he's talking about: "Passkeys should never be allowed to be exported in clear text."[3]

[1] https://www.w3.org/TR/webauthn/

[2] https://passkeys.dev/about/

[3] https://github.com/keepassxreboot/keepassxc/issues/10407

> This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked.

I literally provided a citation.

> Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended.

A syncable credential is by necessity representable in clear text at some point. In comparison, resident WebAuthn private keys NEVER leave the secure device.

> [1] https://www.w3.org/TR/webauthn/

WebAuthn is a _superset_ of Passkeys. Here's the citation from your own linked page:

> This use case illustrates how a consumer-centric Relying Party can leverage the authenticator built-in to a user’s devices to provide phishing-resistant sign in using multi-device credentials (commonly referred to as synced passkeys). ... > A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.

> I literally provided a citation.

That I said does not support your statement.

> A syncable credential is by necessity representable in clear text at some point.

I never said this was wrong.

> WebAuthn is a _superset_ of Passkeys

I don't see how your quote illustrates this, and I've only heard them referred to as the same thing. Would you care to elaborate? And maybe provide an example?

I literally quoted it in the message above:

> multi-device credentials (commonly referred to as synced passkeys).

> A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential.

The previous name for single-device credentials was "resident keys".

So yes, providing a way to export and back up the Passkeys was _literally_ the intention of the WebAuthn authors from the beginning. The ability to export and sync passkeys was not a temporary accident, it has always been intended functionality.

I fail to see how you read that from that quote.

Reply on news.ycombinator.com