6 ms·

> passkeys in Safari requires iCloud Keychain This is not true - browsers including Safari support passkeys managed by third-party password managers. I'm usin

by jmsgwd 9mo ago

> passkeys in Safari requires iCloud Keychain This is not true - browsers including Safari support passkeys managed by third-party password managers. I'm using 1Password with browser extensions for Safari and Chrome on macOS and iOS and it works seamlessly with my passkeys, which are not stored in iCloud Keychain. > you're always locked in to one passkey vendor or another. This will change: https://1password.com/blog/fido-alliance-import-export-passkeys-draft-specs https://1password.com/blog/fido-alliance-import-export-passk...

lapcat 9mo ago
> This is not true - Safari also supports passkeys managed by third-party password managers. I think you know what I meant and are just being pedantic here for no good reason. Do you think I'm unaware of 1Password? I don't want to use 1Password any more than I want to use iCloud Keychain. Technically, pendantically, Safari "supports" anything that third-party Safari extensions support. I'm a Safari extension developer myself. But this is totally different from how Safari supports the use of passwords, which is all built in, requires no third-party software, can be local-only, allows plaintext export/import, etc. > This will change: https://1password.com/blog/fido-alliance-import-export-passkeys-draft-specs https://1password.com/blog/fido-alliance-import-export-passk... This is literally what I meant by the so-called "secure credential exchange" in my previous comment.
- jmsgwd 9mo ago
  OK I see what you mean. Having the ability to switch between vendors but not the ability to export your data locally (e.g. as plaintext keys) is a new meaning of "vendor lock-in" I hadn't considered before.
  - lapcat 9mo ago
    Yes. User freedom is not all-or-nothing. There are degrees, and the tech companies are coming up with fiendish new ways to lock away your data from you. So in the case of passkeys, you can technically move your data between vendors, though that can be quite inconvenient as the submitted article mentions, but nonetheless every vendor locks away your data from you, and most vendors have a financial incentive to keep your data away from you, so that you have to pay for the services.
    - jmsgwd 9mo ago
      Once "secure credential exchange" becomes supported by commercial credential managers, what's to stop someone implementing an open source password manager that implements the standard and allows local export in plaintext?
      - pseudalopex 9mo ago
        Passkeys relying parties can block providers. Tim Cappalli threatened the KeypassXC developers so.[1] The restrictions demanded now do not restrict user freedom significantly arguably. But the incentives and capabilities are clear. [1] https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
        timmyc123 9mo ago
        Hi, Tim Cappalli here. Not sure how stating that my (an individual) opinions on a topic are evolving is interpreted as "threatened the KeypassXC developers". If you've been following along, you'll have seen that I am actually one of the biggest advocates of the open passkey ecosystem, and have been working really hard to make sure all credential managers have a level playing field. Always happy to chat directly if you have concerns!
        pseudalopex 9mo ago
        The threat you relayed was more serious than the threat you made. But it is a threat when a person with influence suggests they may support a punishment. The biggest advocates of an open ecosystem say attestation should be removed and no one should adopt Passkeys before. Is this your position now? The concerns were clear I thought. I would be happy to discuss this publicly.
        timmyc123 9mo ago
        Attestation is not used in the consumer passkey ecosystem.
- unsnap_biceps 9mo ago
  Reading the cfx spec [1], the raw private key is exported as a base64 encoded der. I don't understand what your concern is here. It appears that any cfx export file is not tied to a specific service to service import path, but can be imported into anything, or just used locally with self written tools. 1. https://fidoalliance.org/specs/cx/cxf-v1.0-ps-20250814.html#dict-passkey https://fidoalliance.org/specs/cx/cxf-v1.0-ps-20250814.html#...
  - lapcat 9mo ago
    This is merely the exchange format between credential providers, which is encrypted and gatekeeped by the credential providers. None of this is exported to users.

by jmsgwd 9mo ago

lapcat 9mo ago

> This is not true - Safari also supports passkeys managed by third-party password managers. I think you know what I meant and are just being pedantic here for no good reason. Do you think I'm unaware of 1Password? I don't want to use 1Password any more than I want to use iCloud Keychain. Technically, pendantically, Safari "supports" anything that third-party Safari extensions support. I'm a Safari extension developer myself. But this is totally different from how Safari supports the use of passwords, which is all built in, requires no third-party software, can be local-only, allows plaintext export/import, etc. > This will change: https://1password.com/blog/fido-alliance-import-export-passkeys-draft-specs https://1password.com/blog/fido-alliance-import-export-passk... This is literally what I meant by the so-called "secure credential exchange" in my previous comment.

jmsgwd 9mo ago
OK I see what you mean. Having the ability to switch between vendors but not the ability to export your data locally (e.g. as plaintext keys) is a new meaning of "vendor lock-in" I hadn't considered before.
- lapcat 9mo ago
  Yes. User freedom is not all-or-nothing. There are degrees, and the tech companies are coming up with fiendish new ways to lock away your data from you. So in the case of passkeys, you can technically move your data between vendors, though that can be quite inconvenient as the submitted article mentions, but nonetheless every vendor locks away your data from you, and most vendors have a financial incentive to keep your data away from you, so that you have to pay for the services.
  - jmsgwd 9mo ago
    Once "secure credential exchange" becomes supported by commercial credential managers, what's to stop someone implementing an open source password manager that implements the standard and allows local export in plaintext?
    - pseudalopex 9mo ago
      Passkeys relying parties can block providers. Tim Cappalli threatened the KeypassXC developers so.[1] The restrictions demanded now do not restrict user freedom significantly arguably. But the incentives and capabilities are clear. [1] https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
      - timmyc123 9mo ago
        Hi, Tim Cappalli here. Not sure how stating that my (an individual) opinions on a topic are evolving is interpreted as "threatened the KeypassXC developers". If you've been following along, you'll have seen that I am actually one of the biggest advocates of the open passkey ecosystem, and have been working really hard to make sure all credential managers have a level playing field. Always happy to chat directly if you have concerns!
        pseudalopex 9mo ago
        The threat you relayed was more serious than the threat you made. But it is a threat when a person with influence suggests they may support a punishment. The biggest advocates of an open ecosystem say attestation should be removed and no one should adopt Passkeys before. Is this your position now? The concerns were clear I thought. I would be happy to discuss this publicly.
        timmyc123 9mo ago
        Attestation is not used in the consumer passkey ecosystem.
unsnap_biceps 9mo ago
Reading the cfx spec [1], the raw private key is exported as a base64 encoded der. I don't understand what your concern is here. It appears that any cfx export file is not tied to a specific service to service import path, but can be imported into anything, or just used locally with self written tools. 1. https://fidoalliance.org/specs/cx/cxf-v1.0-ps-20250814.html#dict-passkey https://fidoalliance.org/specs/cx/cxf-v1.0-ps-20250814.html#...
- lapcat 9mo ago
  This is merely the exchange format between credential providers, which is encrypted and gatekeeped by the credential providers. None of this is exported to users.