Looks like a huge amount of security vendors are working to have a secure and open standard for passkey portability between platforms.

It is always good to see major collaboration in the security space like this considering the harsh opinions that users of some of these vendors have toward many of the others. I just wish apps and sites would stop making me login with username and password if passkeys are meant to replace that lol.

  • Pasta Dental@sh.itjust.works
    link
    fedilink
    arrow-up
    46
    arrow-down
    12
    ·
    edit-2
    1 month ago

    I don’t like that passkeys are portable, this kind of defeats the entire purpose. The way they were sold to me is the following: it’s 2 factors in one. The first is the actual device where the key lives, and the second, the user verification, like a pin, face scan, fingerprint etc. If it’s synced across the cloud, there’s no longer the first factor being the unique key on the unique device.

    Granted, passkeys even without the first factor are still magnitudes better in terms of convenience and security compared to passwords, but it just disappoints me a little that there are no good options to save passkeys on my local device only, with no cloud sync.

    If anyone knows of a local-only passkey manager app for android, as well as the same as a firefox extension, I’d love to know about it!

    • ryannathans@aussie.zone
      link
      fedilink
      arrow-up
      43
      ·
      1 month ago

      If you don’t want to sync your credentials with a server, why are you using a server based credential manager?

      • Pasta Dental@sh.itjust.works
        link
        fedilink
        arrow-up
        6
        arrow-down
        2
        ·
        1 month ago

        For 2 reasons:

        • I want to sync my credentials that cannot be made unique and revocable (ie passwords). I can have a single passkey per device, I cannot have a password per device for a same account. I also have to memorize a password, and I have hundreds that I may need to access while I am away and only have my phone.
        • I use one because currently I have not found a convenient way to save local passkeys on Android and my Linux PC.
        • Petter1@lemm.ee
          link
          fedilink
          arrow-up
          4
          ·
          1 month ago

          You can save local passkeys using a local keepass file and keepassXC. No cloud needed.

    • m-p{3}@lemmy.ca
      link
      fedilink
      arrow-up
      33
      ·
      1 month ago

      I guess you’re better off buying a physical security key, which offers some guarantee that the keys cannot be exflitrated from the device.

        • m-p{3}@lemmy.ca
          link
          fedilink
          arrow-up
          21
          ·
          1 month ago

          Strange, my Yubikey allows me to authenticate using Passkeys just fine by entering the PIN that protects my stored credentials.

          • Flying_Hellfish@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 month ago

            I love my Yubikey but the older hardware versions can only store 25 passkeys, and I believe even the newer ones can only store 100. That seems like a lot until more sites start allowing passkey auth.

            • lud@lemm.ee
              link
              fedilink
              arrow-up
              2
              ·
              1 month ago

              Sure, but I don’t think it’s a huge problem since it’s honestly pretty hard to find more than 5 services that support discoverable passkeys.

    • MangoPenguin@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      15
      ·
      1 month ago

      If they’re not portable how would I for example login to an account while on my Desktop, if I set up the passkey on my Phone?

        • kautau@lemmy.world
          link
          fedilink
          arrow-up
          15
          arrow-down
          1
          ·
          1 month ago

          Assuming that all services you log into support multiple passkeys. My auto financing company doesn’t, for example

          • Petter1@lemm.ee
            link
            fedilink
            arrow-up
            1
            ·
            1 month ago

            Well, then it seems like they have not understand the idea behind passkeys, like so many…

            • timbuck2themoon@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              3
              ·
              1 month ago

              I’d like to see some documentation that says passkeys were intended to never be synced across anything.

              Everything I have ever read is that it’s basically asymmetric cryptography like ssh keys. You have a private one, generate the public and give it to the site. It stops reuse of passwords and site breaches become useless as the public key is useless for attacking an account on another site, etc. (well, besides whatever data was lost in the breach which is outside the scope.)

              I see no reason to limit someone having the private key on their phone, their desktop, etc. Having to generate yet another passkey for every device is inefficient and would decrease adoption of this.

              • Petter1@lemm.ee
                link
                fedilink
                arrow-up
                2
                ·
                1 month ago

                Yea, ssh private keys as well are intended to only stay on Device that generated it. The idea is, that the device you want to connect to has all the puplic keys of all devices you want connect from in their known hosts directory. And you should not transfer private keys.

                But of course there is always a battle between convince and security, so there were ways created to transfer encrypted private keys protected with a password.

                And the same happened to passkeys.

                I myself choose convenience over security in that regard and share my private keys and passkeys on my devices and thus am happy about that development.

                The thing is, having options is often good, so a person should be able to choose passkeys in the secure way where you can invoke each device individually and never have the passkey to leave the device where it was generated. To achieve this, website need to allow multiple passkeys to be used, and would be expected from a bank, in my opinion. Maybe they think it is more secure to have just one passkey on one device, which it is, but how do you recover your account if that device dies?

        • Cyno@programming.dev
          link
          fedilink
          arrow-up
          8
          ·
          1 month ago

          Doesn’t that imply you still have to open up your phone to temporarily share to your pc whenever you need it?

        • lud@lemm.ee
          link
          fedilink
          arrow-up
          1
          ·
          1 month ago

          That doesn’t transfer the private key though (or at least it shouldn’t).

          I’m pretty sure it’s just transferring public keys and signing the response with the private key on your phone.

    • warm@kbin.earth
      link
      fedilink
      arrow-up
      15
      ·
      1 month ago

      Them being portable makes them actually useful though for me, unless there was a way to use them from a phone to login to a website on a desktop/other device.

      Being able to login into a password manager and use a passkey is great, passkeys need to become mainstream to get everyone away from passwords, but they can’t be locked locally onto one platform or you have issues. The regular joe won’t be backing them up from their iPhones or whatever.

      I don’t see why a local option wouldn’t exist though, perhaps they will come once passkeys have matured further.

      • Pasta Dental@sh.itjust.works
        link
        fedilink
        arrow-up
        22
        ·
        1 month ago

        I read the post more closely and saw that this isn’t about syncing the keys across password managers, it’s about transfering them to a different password manager/device. In that case I’m okay with the initiative. This is to prevent lock-in and I’m all for it.

        • Petter1@lemm.ee
          link
          fedilink
          arrow-up
          1
          ·
          1 month ago

          Transferring a passkey means it has to be portable which they already are, since I have mine portable since about 6 months using a keepass file on my private cloud.

    • Cethin@lemmy.zip
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 month ago

      They should be portable. I don’t know if they should be stored in the cloud though. Ideally you can open a password database in whatever application you want if you have the database and login information. Not allowing this is inconvenient and doesn’t seriously increase security.

      Having them not be portable ensures people use them less frequently. If I couldn’t sync mine between my phone and desktop I probably wouldn’t use it. The way I do it isn’t built into my manager (KeepassDX), but I use Syncthing to keep it up to date on both devices. It’d be better if there was an official option for people bad with technology.

    • Soothing Salamander@lemmy.mlOP
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 month ago

      Admittedly, for some password managers, the passkeys are stored locally and are not accessible in the cloud unencrypted without the decryption keys that exist on devices you authorize.

      This may still not make a difference for you though. For me, I consider passkeys, even stored in the cloud, to be enough for the vast majority, so I appreciate these vendors working to make passkeys more easy for the end user.

      • Pasta Dental@sh.itjust.works
        link
        fedilink
        arrow-up
        2
        ·
        1 month ago

        I agree and I still store my passkeys in proton pass, but that’s more because there’s no real option for storing them locally only. I really like passkeys and they make me optimistic about the future, it’s just that I think the way they should work is that each device should have a passkey registered to an account, so that the access can then be revoked if the device was compromised. And it’s even convenient in this way with the QR codes that you can use to temporarily share a passkey to then be able to add the new device.

    • Zomg@lemmy.world
      link
      fedilink
      arrow-up
      1
      arrow-down
      1
      ·
      1 month ago

      Setup 1password with a physical security key might fix that issue somewhat.