Re:Bitwarden Acquires Passwordless.dev
by antihero on Wednesday January 18, 2023 @11:23AM
(#34428753)
It’s cool but until Apple lets Firefox use said keychain I’m not going to use it.
Re:Bitwarden Acquires Passwordless.dev
by toomuchtodo on Wednesday January 18, 2023 @02:25PM
(#34431643)
Most people will though, because they’re either in the Android or Apple ecosystems.
Yeah but only being about to login to something if you’re on a certain ecosystem is horrible lock in. It’s why I always choose email sign in over Apple.
Re:Bitwarden Acquires Passwordless.dev
by toomuchtodo on Saturday January 21, 2023 @03:06PM
(#34469832)
The standard has portability mechanisms, both for ad hoc authentication across ecosystems (I logged into login.gov yesterday on Chrome browser using my iPhone passkey) as well as exporting passkeys to ecosystem independent vaulting systems.
It makes sense to approach this new paradigm with a healthy dose of skepticism, but there is evidence your concerns have solutions.
Firefox should have a platform entitlement that lets them just delegate to Apple's implementation when available. This is I believe what they do on Windows.
As for how "passwordless" plays into this, Passkeys are generally better than passwords simply because it's PGP instead of a shared secret you send to the website, so even if a website is compromised, there's effectively 0 way the compromised database will enable password stuffing attacks on other websites.
Another cool thing is QR codes via caBLE (cloud assisted BLE), you can scan a QR code on a browser (on a bluetooth-enabled computer) to have your phone connect to that computer and present its passkey to the computer, without needing to actually plug in your device to the computer. This is not strictly a passkey thing, it just aids in making them usable.