News for hackers. Stuff that matters.
Re:Bitwarden Acquires Passwordless.dev by judge2020 on Wednesday January 18, 2023 @10:32AM (#34427893)
Passkeys are effectively software security keys, stored in whatever keychain you're using (Chrome or iCloud Keychain or otherwise); for the major implementations you're hearing about, the goal of their implementation is improving the UX by syncing your passkeys between devices, so as long as you can access your passkey keychain, you won't have to worry about losing your security key for that website.

As for how "passwordless" plays into this, Passkeys are generally better than passwords simply because it's PGP instead of a shared secret you send to the website, so even if a website is compromised, there's effectively 0 way the compromised database will enable password stuffing attacks on other websites.

Another cool thing is QR codes via caBLE (cloud assisted BLE), you can scan a QR code on a browser (on a bluetooth-enabled computer) to have your phone connect to that computer and present its passkey to the computer, without needing to actually plug in your device to the computer. This is not strictly a passkey thing, it just aids in making them usable.

Re:Bitwarden Acquires Passwordless.dev by antihero on Wednesday January 18, 2023 @11:23AM (#34428753)
It’s cool but until Apple lets Firefox use said keychain I’m not going to use it.
Re:Bitwarden Acquires Passwordless.dev by toomuchtodo on Wednesday January 18, 2023 @02:25PM (#34431643)
Most people will though, because they’re either in the Android or Apple ecosystems.
Re:Bitwarden Acquires Passwordless.dev by antihero on Friday January 20, 2023 @08:48AM (#34453044)
Yeah but only being about to login to something if you’re on a certain ecosystem is horrible lock in. It’s why I always choose email sign in over Apple.
Re:Bitwarden Acquires Passwordless.dev by toomuchtodo on Saturday January 21, 2023 @03:06PM (#34469832)
The standard has portability mechanisms, both for ad hoc authentication across ecosystems (I logged into login.gov yesterday on Chrome browser using my iPhone passkey) as well as exporting passkeys to ecosystem independent vaulting systems.

It makes sense to approach this new paradigm with a healthy dose of skepticism, but there is evidence your concerns have solutions.

Re:Bitwarden Acquires Passwordless.dev by dwaite on Thursday January 19, 2023 @01:58AM (#34437475)
Firefox should have a platform entitlement that lets them just delegate to Apple's implementation when available. This is I believe what they do on Windows.
Re:Bitwarden Acquires Passwordless.dev by antihero on Friday January 20, 2023 @08:47AM (#34453033)
I think they need to be in the App Store for this and I’m not sure why they aren’t.