Security vendors join forces to make passkeys more portable for everyone | Bitwarden Blog
bitwarden.com
FIDO Alliance publishes industry standards for consumers to easily and securely transfer passkeys across platforms and password managers.

Looks like a huge amount of security vendors are working to have a secure and open standard for passkey portability between platforms.

It is always good to see major collaboration in the security space like this considering the harsh opinions that users of some of these vendors have toward many of the others. I just wish apps and sites would stop making me login with username and password if passkeys are meant to replace that lol.

  • @[email protected]English
    15•1 month ago

    If they’re not portable how would I for example login to an account while on my Desktop, if I set up the passkey on my Phone?

      • @kautau
        14•1 month ago

        Assuming that all services you log into support multiple passkeys. My auto financing company doesn’t, for example

          • @[email protected]English
            3•1 month ago

            I’d like to see some documentation that says passkeys were intended to never be synced across anything.

            Everything I have ever read is that it’s basically asymmetric cryptography like ssh keys. You have a private one, generate the public and give it to the site. It stops reuse of passwords and site breaches become useless as the public key is useless for attacking an account on another site, etc. (well, besides whatever data was lost in the breach which is outside the scope.)

            I see no reason to limit someone having the private key on their phone, their desktop, etc. Having to generate yet another passkey for every device is inefficient and would decrease adoption of this.

            • @[email protected]
              2•1 month ago

              Yea, ssh private keys as well are intended to only stay on Device that generated it. The idea is, that the device you want to connect to has all the puplic keys of all devices you want connect from in their known hosts directory. And you should not transfer private keys.

              But of course there is always a battle between convince and security, so there were ways created to transfer encrypted private keys protected with a password.

              And the same happened to passkeys.

              I myself choose convenience over security in that regard and share my private keys and passkeys on my devices and thus am happy about that development.

              The thing is, having options is often good, so a person should be able to choose passkeys in the secure way where you can invoke each device individually and never have the passkey to leave the device where it was generated. To achieve this, website need to allow multiple passkeys to be used, and would be expected from a bank, in my opinion. Maybe they think it is more secure to have just one passkey on one device, which it is, but how do you recover your account if that device dies?

      • @[email protected]
        8•1 month ago

        Doesn’t that imply you still have to open up your phone to temporarily share to your pc whenever you need it?

        • Pasta Dental
          3•1 month ago

          Yes but when you are logged in, you can add the passkey that belongs to the new device to your account

      • @[email protected]
        1•1 month ago

        That doesn’t transfer the private key though (or at least it shouldn’t).

        I’m pretty sure it’s just transferring public keys and signing the response with the private key on your phone.