Re:Don't use passkeys for encrypting user data
by javier2 on Saturday February 28, 2026 @06:40AM
(#47193978)
except... i store my password for work in bitwarden, so I dont want to also keep my work passkeys in the same place. For my personal stuff, that is a risk I can live with so far, but for work it seems dumb.
Re:Don't use passkeys for encrypting user data
by lxgr on Saturday February 28, 2026 @07:31AM
(#47194518)
Yeah, definitely don’t mix work and personal credentials. But many password managers allow using different accounts/vaults on one machine.
Re:Don't use passkeys for encrypting user data
by ezfe on Saturday February 28, 2026 @04:09PM
(#47200259)
Your Bitwarden should enforce the necessary 2-Factor auth for this scenario, but if you’re worried just make sure to be careful when registering that single passkey.
Re:Don't use passkeys for encrypting user data
by freeopinion on Saturday February 28, 2026 @02:04PM
(#47198983)
> This works across OSes and browsers.
It doesn't work for me in Firefox on Linux. I'm very curious to know how it works for you.
Re:Don't use passkeys for encrypting user data
by lxgr on Saturday February 28, 2026 @03:01PM
(#47199572)
Does their Firefox extension not inject its own WebAuthN implementation into every visited site on Linux? It does for me on macOS (i.e. it overrides the OS/browser-provided one).
Re:Don't use passkeys for encrypting user data
by tredre3 on Saturday February 28, 2026 @06:27PM
(#47201630)
Is this really how password managers extensions work? They inject arbitrary javascript in every page you visit?
I would have naively thought that there'd be a better and safer API for it, considering that all browsers already have the infrastructure in place to handle login autocomplete.
Re:Don't use passkeys for encrypting user data
by varjolintu on Sunday March 01, 2026 @11:05PM
(#47213763)
Yes. This is mandatory for all browser extensions. There's no API behind a separate permission, even if would be the best way to handle this.
Re:Don't use passkeys for encrypting user data
by bpye on Saturday February 28, 2026 @08:00PM
(#47202435)
As someone that uses a YubiKey for WebAuthN - I really wish Bitwarden didn't do this. I know I can turn it off, but it's a bad default.
Re:Don't use passkeys for encrypting user data
by Cyph0n on Saturday February 28, 2026 @10:30PM
(#47203399)
The problem with passkeys is that they aren’t exportable (at least from Bitwarden).
Re:Don't use passkeys for encrypting user data
by nerdsniper on Sunday March 01, 2026 @01:35PM
(#47209398)
They are easily exportable from Apple and 1Password AFAIK. Bitwarden seems to be doing some interesting lock-in, and while I have loved them, I no longer have a commercial password manager that I trust (leaving me with only Apple's as a high-functioning, high-trust option). I'm worried about effects of private equity pressure on groups like 1Password, Bitwarden, and LastPass (I strongly recommend against LastPass these days).
Re:Don't use passkeys for encrypting user data
by lxgr on Monday March 02, 2026 @06:17AM
(#47216498)
Bitwarden's format is at least implicitly documented via their open-source clients, and as a sibling comment already has mentioned, their data export includes all private/secret key material.
Re:Don't use passkeys for encrypting user data
by varjolintu on Sunday March 01, 2026 @11:04PM
(#47213748)
Actually, if you export your vault as JSON, the passkeys are there in plain-text.
Mine is Bitwarden, and that's available on pretty much all platforms, natively where available (except on macOS currently), as a browser extension otherwise.
For the rare instance in which I need to authenticate using a passkey on a computer where I'm not logged into Bitwarden, there's the cross-device CaBLE flow where I can scan a QR code with my phone and use Bitwarden to authenticate. This works across OSes and browsers.