Apple's keychain or google password manager - can hold 2000 passkeys easily.

Nothing in the post you're replying to is about "is 2000 passkeys storable", it's about "if I have 2000 passkeys and I need to move between an Apple device and an Android device, do I need to establish a second set of 2000 passkeys"?

No you don't. I use the same passkeys for all my devices sync'd with bitwarden.

Exactly. Bitwarden, not the Apple/Google/Microsoft keychain. That's the problem.

Not at the moment. But if you sign into google account in iPhone then you can use Google's passkeys in iPhone.

At the end, passkeys are built not for the tin-foil, (I hate Google Apple fellows), I want to keep every single locally, RMS fans. No.

A majority will benefit. End of matter.

A majority don't change platforms (I have not seen them do it).

And lets be honest - even if they were portable are you privacy person that is going to do it? No.

No, the majority will not. If through some miracles, passkeys gain sudden and wide adoption, there will be a day of reckoning come around the next mobile refreshment cycle, maybe earlier.

People break their phones. That is normal experience. Entirely unsupported by passkeys as they are today.

I'm actually surprised we didn't have more pushback for ubiquitous 2FA, as they have similar threat profile - i.e. addressing the tin-foil threats of cybersecurity aficionados, while entirely ignoring the common threats to real people, in particular the one of broken or lost mobile device.

Incorrect. They break but they fix it.

People break their phones less often compared to telling them keep their keepassdatabase in sync across devices.

Even recently my friend fixed his iPhone XR (10 year old) 3rd party. Everything including passkeys work fine.

Did you not read the comment thread you're responding to?

Dunno why the downvotes, if you're willing to trust Apple or Google this is a good method for passkey usage. because your touchID/faceid/opticalid auth gate the keyring's on either of these vendors your passkey works without having to migrate them. EDIT: Also ANY device that you add to your iCloud has access to the passkeys you've made... it's a dream for secure access.

What happens when the user decides to move to an Android device, or even is suspended from Apple for a suspected breach of the terms of service, or Apple decides to not support their country anymore? There are countless reasons to prefer to manage one's own access.

True... Theoretically correct but in practical sense?

All these doom mongering of suspension happens so rarely that majority don't care.

There are countless reason to DIY. Agree. But passkeys will help the majority.

Also note that the kind of people - like journalists etc - that need to use DIY/local are the ones that are likely to use passkey. Reality.

The downvotes are because the commenter did not read or at least did not fully comprehend the meaning of the post they were responding to.

Downvotes does not matter. People here that are privacy inclined always find ways to argue about Google or Apple (any major companies). But if you look at their private lives - they adopt tech ASAP. A majority have Apple Pay or Google Pay. Paypal. At the same time use bitwarden also. (And that is fine)

These privacy zealots fail to realise that majority of population does not have time to setup bitwarden server or lineageos or zfs storage etc.

Passkey comprises of public key that the website you created it on holds, and the private key you store on your pw manager or in the TPM/secure element. As long as you can copy the private key to the new device, you don't need to recreate the whole passkey. In your case, you would just need access to a backup of the Keepass database in case you lose the device.

The biggest point of confusion in my opinion comes from Windows especially having lacked a way (and kind of still does) to save the private key of a passkey to your password manager, defaulting to saving it to Windows Hello, which saves the private key to your PC's TPM. In this scenario you can no longer easily copy the private key to other devices, and if you lose that Windows PC, you also lose the private key and the whole passkey as a result.

People who say users should not be able to export keys are not confused. They believe users should not be able to export keys.

I was referring to confusion experienced by people new to the passkeys creating passkeys for the first time ("Where am I saving this to?", "How do I store this in my password manager?").

dotancohen would not be allowed to store Passkeys private keys in a Keepass database in the case thewebguyd specified. Relying parties would block password managers which allowed this.

You don’t. You don’t store anything at all.

On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or hardware. The encrypted blob is sent to the server and stored there.

On authentication, after you enter your login, the server sends the encrypted blob and your security key tries to decrypt it with the long-term key it has. If it succeeds, it then request a challenge from the servers, signs it along with the server name and timestamp and sends back to the server. Server validates the signature and if it’s good, log you in.

Expanded: As long you as the user has the security key fob, you can login. You should have 2.

> You don’t. You don’t store anything at all.

Yes, you do.

Whenever a website offers to create a passkey, it could end up in any of these:

- Samsung's Password Manager (if using a Samsung phone)

- Apple's Keychain (if using an iPhone)

- Google Password Manager

- Your operating system's keychain

- A bespoke password manager (e.g., Bitwarden or LastPass)

- Your hardware key

Most users do not have a security key fob. Instead, the proposal being mostly pushed is the idea that users can store keys on their own smartphones, making use of the modern TPM and chip security. Most of the discussion here revolves around that idea: "What if I lose my phone? What if I switch phones?" and that's why the problems seem so obvious to you.

I absolutely agree the best solution is to use hardware keys, but I'll admit it's cumbersome if I need them for hundreds of accounts (which I do have), having to register both for every website and praying that I never lose both at the same time in the case there's no viable recovery flow for some of the accounts. Also, most of these hardware keys are limited to 25 or 100 resident keys, which again makes them unable to substitute passwords. Observe the usage of the term resident keys: passkeys do rely on the private key being stored on the hardware key, as that allows discovery.

I was talking about the non-resident FIDO keys. “Passkey” term is meaningless unfortunately because FIDO Alliance did not define it initially, it was a marketing term invented by Apple and then re-introduced (or shoved down the throat) by the FIDO alliance.

In non-resident keys scenario you don’t store anything and from what I see there is no security downside of using non-resident keys.

Loosing both (or multiple) security keys is like loosing all your car or home keys. Very inconvenient, agreed.

Anyway, I think we can agree that FIDO authentication protocol implementation is a mess. Apple and Google made it messy because they wanted to lock down users to their platforms and then password managers followed. As a result, the current implementation is not more secure than “login with Apple” or “login with Google”.

I agree!

Indeed, the only advantage to Resident Keys (i.e., Passkeys) is the discoverabillity of them, so you can login without even using a username. It's a shame all of the terminology around WebAuthn/FIDO2 and Passkeys is so loose and badly defined.

Honestly, I think OAuth logins are still an ok option for the average user, unfortunately, as I would never recommend someone I love to use Passkeys and put them through the burden of having to understand and deal with all of this mess.

I have deployed FIDO authenticators at a ~2000 employees organization as the second factor. It was great for a while - when early versions of macOS and iOS respected the “platform” claim and created non-exportable private keys backed by Secure Enclave. Windows was never a problem, keys were created in TPM. We mandated 2 FIDO credentials - typically the laptop and either a phone or Yubikey (or both). People were encouraged to use the later but as soon as the keys were not exportable, phones were acceptable.

Then, Chrome got an update and started hijacking the enrolment process from the operating system and created keys synced to Google Account. This resulted worse UX because authentication now required pulling the Android phone (for those unlucky ones who have it) and confirming the login there instead of doing it right on the computer, uninterrupted.

Then, Apple followed with cloud-only key pairs and then so did the password managers (including Bitwarden Enterprise we were using) and everything become a mess.

The only solution would be to use the key attestation and to only allow specific security keys. Both Chrome and Apple have config knobs to simplify enterprise attestation (a strong assurance, which FIDO authenticator has been used), but neither Windows nor macOS support key attestation for hardware-backed keys (and macOS ignores “platform” claim altogether).

It sucks.

I have to think people aren't doing any research. Both Android and Apple sync your passkeys to your account. You can toss all your devices in a wood chipper, buy a replacement and still have access to all your passkeys.

Yeah, they do. But what if you want to move from Android to iPhone or vice versa? That's the big problem regarding these keychains/password managers. Some of them didn't even allow you to export your Passkeys until a few months ago, meaning you were literally locked into their platform.

Remember that your average user has no idea what a passkey is, doesn't remember half of their passwords and has no idea what a password manager is.

If you want to change it maybe tough. It doesn't have to be. Bitwarden has an open source self hosted option(you can also use their service), that can be set as provider in Android and Windows 11. KeepassXC is an option everything is in your kdbx file. Passkeys are so much more convenient and secure. If you do get stuck having to migrate, you can use your password (I would actually prefer just using multiple passkeys.) You don't need to do them all at once. Your average user is probably using whatever their device offers or nothing at all. I'd argue anyone that is tech savvy shouldn't be using either Google or Apple. If your account is disabled, you probably just lost anyway to retrieve your account unless you use a separate email address. I recently discovered cross device auth when a device I had a passkey was able to open my account on my pc that didn't have a passkey. TLDR ther are simple solutions that solve the 'lock in' issue.

So the use of Passkeys is contingent on allowing a major tech firm to spy on you?

I actually do have a Google account, but do not link my (Android) phone to it. I don't have WhatsApp or any other spyware on the device. I do use Telegram, Ankidroid, and a few other apps that I trust. I'm not a fanatic, but I won't enable and abet anybody to follow me around and report all that I do. How my position is considered an extreme position today eludes me, and frightens me as well.

The original U2F tokens didn't suffer from this problem that much. It contained one secret, it relied on the website to store and return an opaque website-and-account-specific blob, which was decrypted by the token and used to sign the login request. It would be reasonably easy to expand this in a way where the server also stores a backup credential for use by your second/third/whatever hardware token, encrypted with an asymmetric key during the enrollment of the primary token.

But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.

This. I would have loved if this original u2f existed. Google has even removed this from their accounts.

> But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.

This part of your comment is incorrect. Discoverable Webauthn absolutely can be used with hardware tokens like Yubikeys.

> Let's assume that they were all Passkeys.

Lets assume I put all the effort to explain.

I will give you a better example.

- Lets say you have a google account with pixel phone

- You are using it and added 1000 passkeys

- All are synced to your Google account

- Destroy and Get a new phone. Login to your google account with recovery code.

- All your passkeys are in your phone again.

There are plans in fidoalliance.org to make it portable. Pretty sure you are still not going to move to it.

It works fine until Google suddenly decides that your new device is not you and asks you to confirm login from previous device...

Or until Google decides that you did a wrongthink and bans your account, including locking you out of your old phone.

Oh look, the strawman is a victim

See.. the sad thing for doomsayers like you is that if even 1% of users were affected then there would be mass exodus from Gmail. It does not.

Yes, you don't use Gmail so it does not matter. You may be don't know. And often even average Joe some how has a oldphone or iPad that has oldgmail account there or logged into wife's phone or phone based SMS whatever.

it is ok to hate passkeys or google or love only self-hosted but let others do what they want.

I have been user of solokeys (since the first one) - only opensource hardware keys. works for me...

But if you go to the local highstreet then there are tons of people doing this screenrepair etc just to recover the account. Average Joe doesnot mind paying for that. Even will give the repair guy full password to transfer all data from old to new phone.

1) Install a keepass client and use it for passkeys.

2) See #1

3) See #1

KeepassXC supports passkeys. They suggest a couple mobile apps that also do.

How easy is it to switch off keepass? And how easy is it to export off whatever you imported to? Passwords are simple, just remember the text. Passkeys have alot of uncertainty around this

To switch off, just stop using Keepass. If you want want delete the entry on the site. You don't need to, since your Keepass file should be secure and passkeys are designed allow multiple for a site. Passwords are not equal to passkeys and not difficult to add. Everyone seems to think you need to create new passkeys for all your websites. You don't, add them as you go. The hassle of adding it should be less than using a password to login.