6 ms·

"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider th

by throw7 14d ago

"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider that not controllable by me. I'm happy to be wrong if I am able to extract and import the private keys (it's what I do with TOTP now), but my understanding is designers of passkeys explicitly don't want users access to their own privkeys so they can tie them to physical objects. I get that, I don't want that. So passkeys are not something I'll ever use or useful or convenient to me.

erincandescent 14d ago
If you're using a hardware device, you can't extract them, because that's the point. If you're using a password manager to store your passkeys, there are protocols to move them between password managers.
- someguydave 14d ago
  okay but on apple devices (for instance) I believe the private keys are stored in the icloud keychain, otherwise there would be no passkey portability between your apple devices
dfabulich 14d ago
Bitwarden lets you extract and import passkeys. Apple, Google, Microsoft, and 1Password don't support that directly, but they do support a finicky app-to-app transfer system, where you install two password-manager apps on the same device, and you directly export your passkeys from one app to another. It's called the "Credential Exchange Protocol" (CXP). Bitwarden's app can receive CXP passkeys, so you can install a passkey in Apple's password manager, CXP it to Bitwarden, and then export it to a file that you control. Putting the file under your control does make it possible for someone to trick you into sending you that file, undermining some of the phishing protections of passkeys. It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.
OkayPhysicist 14d ago
KeypassXC was threatened with blacklisting for deigning to let users access their private keys. Passkey Consortium lackeys will try and reassure you that you have control over your keys, but they are lying through their teeth.

by throw7 14d ago

erincandescent 14d ago

If you're using a hardware device, you can't extract them, because that's the point. If you're using a password manager to store your passkeys, there are protocols to move them between password managers.

someguydave 14d ago
okay but on apple devices (for instance) I believe the private keys are stored in the icloud keychain, otherwise there would be no passkey portability between your apple devices

dfabulich 14d ago

Bitwarden lets you extract and import passkeys. Apple, Google, Microsoft, and 1Password don't support that directly, but they do support a finicky app-to-app transfer system, where you install two password-manager apps on the same device, and you directly export your passkeys from one app to another. It's called the "Credential Exchange Protocol" (CXP). Bitwarden's app can receive CXP passkeys, so you can install a passkey in Apple's password manager, CXP it to Bitwarden, and then export it to a file that you control. Putting the file under your control does make it possible for someone to trick you into sending you that file, undermining some of the phishing protections of passkeys. It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.

OkayPhysicist 14d ago

KeypassXC was threatened with blacklisting for deigning to let users access their private keys. Passkey Consortium lackeys will try and reassure you that you have control over your keys, but they are lying through their teeth.