News for hackers. Stuff that matters.
Re:Passkeys: A Shattered Dream by recursive on Friday April 26, 2024 @09:57PM (#40176423)
I'm a happy user of 1password also. But I'm not touching passkeys until they let me export them. Last time I checked, it was a platform lock-in.
Re:Passkeys: A Shattered Dream by jackson1442 on Saturday April 27, 2024 @12:25AM (#40177226)
You can export them- just did so by touching the context menu on the mobile app then “copy item JSON.” This includes the private key for the passkey. Here’s one I just exported: https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee9...

Whether or not you can import them into something else though…

Re:Passkeys: A Shattered Dream by scient on Saturday April 27, 2024 @10:19AM (#40180153)
The whole original point of what underpins FIDO2 was device locked, unphishable credentials. Wanting to export and move passkeys between devices is kind of counter to that. And I would argue vendors completing the attestation process are much more trustworthy than storing your own keys god knows where.
Re:Passkeys: A Shattered Dream by recursive on Saturday April 27, 2024 @01:00PM (#40181525)
Oh, ok. If that's the same thing as passkeys, then I finally figured out that I'm not interested. To me it looks like another vector for platform lock-in, or getting mysteriously locked out of my accounts with no recourse. I'll wait for FIDO3.
Re:Passkeys: A Shattered Dream by Groxx on Sunday April 28, 2024 @01:25AM (#40186213)
Yep. I absolutely refuse to support anything that wants to dictate what I do with my identity.

Such things do have purposes, in high-stakes environments. They prevent accidents. The vast majority of uses on the public web are not even remotely in that realm. It'd be better off being a separate spec that only a handful of internal-only systems use, ideally requiring MDM to set up conveniently (to strongly discourage normal and even high-stakes-normal website usage).

My banking website has absolutely no business knowing and being able to approve or deny what brand my authenticator is.