Keepassxc and strongbox passkey integrations seem pretty good on all of the OSes and browsers I've used.
I think passkeys make a messy credential situation even messier, but make a tidy credential situation even tidier.
I think passkeys make a messy credential situation even messier, but make a tidy credential situation even tidier.
Not to mention the only way to blacklist a specific app from Passkeys is to use the AAGUID from attestation which means it only applies to attestation. A few pieces of software were providing AAGUIDs by choice even when not attested and Apple helped remind them that the spec says non-attested Passkeys should always just return an Empty UUID (all zeroes) in AAGUID. The people that are going to block non-attested Passkeys might as well block all of them, including Apple consumer Passkeys.
Isn't that a single vendor (or two)? How is this not lock-in?
> Passkeys should never be allowed to be exported in clear text.
and from another comment by the issue creator:
> I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here.
They're arguing for storing them in encrypted form. That's very much a different argument than arguing against exporting. I'm not taking any sides here, I just think it's bad to so badly misrepresent people's standpoints.
Such security, very rules, wow.
Because an ZIP file with the encrypted key and the password to it in plain text is sooooo much more secure (but it doesn't break the rules, right?).
The complaint wasn't in allowing credentials to move (that is the point of the CXF and CXP work). The complaint was in having sensitive data in a plaintext file live long-term without any protections. That is also why one of Tim's early recommendations was to require encrypting the file via a passphrase.
Ultimately if a user wants control over their own keys so they can have a failsafe for recovery (and handle the safety of those exports themselves) they should be able to do so. Until we have very safe mechanisms for backups of passkeys we'll never be able to truly disable other very insecure forms of account recovery without too much risk.
[Passkeys] should never be exported in clear text
Overview
Passkeys should never be allowed to be exported in clear text.
[...]
Please explain how self hosting open source software is locking me into a vendor.
If the sky falls and strongbox ceases working with mac/iOS I can use android and linux. Nobody is locking my lockbox.
> Store your data anywhere you like, online or offline. Sync with every major cloud storage provider or your own server over WebDAV or SFTP. Use your Strongbox database with any KeePass compatible client on any platform.