this post was submitted on 14 Oct 2024
474 points (99.8% liked)

Privacy

31605 readers
473 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS
 

Looks like a huge amount of security vendors are working to have a secure and open standard for passkey portability between platforms.

It is always good to see major collaboration in the security space like this considering the harsh opinions that users of some of these vendors have toward many of the others. I just wish apps and sites would stop making me login with username and password if passkeys are meant to replace that lol.

(page 2) 18 comments
sorted by: hot top controversial new old
[–] [email protected] 34 points 2 days ago* (last edited 2 days ago) (10 children)

I don't like that passkeys are portable, this kind of defeats the entire purpose. The way they were sold to me is the following: it's 2 factors in one. The first is the actual device where the key lives, and the second, the user verification, like a pin, face scan, fingerprint etc. If it's synced across the cloud, there's no longer the first factor being the unique key on the unique device.

Granted, passkeys even without the first factor are still magnitudes better in terms of convenience and security compared to passwords, but it just disappoints me a little that there are no good options to save passkeys on my local device only, with no cloud sync.

If anyone knows of a local-only passkey manager app for android, as well as the same as a firefox extension, I'd love to know about it!

[–] [email protected] 42 points 2 days ago (2 children)

If you don't want to sync your credentials with a server, why are you using a server based credential manager?

load more comments (2 replies)
[–] [email protected] 4 points 2 days ago

Keepassdx is actively working on this

[–] [email protected] 2 points 2 days ago

Loos like no one knows of Enpass

[–] [email protected] 15 points 2 days ago (2 children)

If they're not portable how would I for example login to an account while on my Desktop, if I set up the passkey on my Phone?

[–] [email protected] 11 points 2 days ago (4 children)

You generate a second one on the other device.

load more comments (4 replies)
[–] [email protected] 2 points 2 days ago (2 children)

There are already systems in place that allow temporary passkey sharing, for example with a QR code (CaBLE) https://www.corbado.com/blog/webauthn-passkey-qr-code

[–] [email protected] 8 points 2 days ago (1 children)

Doesn't that imply you still have to open up your phone to temporarily share to your pc whenever you need it?

load more comments (1 replies)
load more comments (1 replies)
[–] [email protected] 6 points 2 days ago

They should be portable. I don't know if they should be stored in the cloud though. Ideally you can open a password database in whatever application you want if you have the database and login information. Not allowing this is inconvenient and doesn't seriously increase security.

Having them not be portable ensures people use them less frequently. If I couldn't sync mine between my phone and desktop I probably wouldn't use it. The way I do it isn't built into my manager (KeepassDX), but I use Syncthing to keep it up to date on both devices. It'd be better if there was an official option for people bad with technology.

[–] [email protected] 3 points 2 days ago

The user should be able to do whatever they want.

[–] [email protected] 5 points 2 days ago (1 children)

Admittedly, for some password managers, the passkeys are stored locally and are not accessible in the cloud unencrypted without the decryption keys that exist on devices you authorize.

This may still not make a difference for you though. For me, I consider passkeys, even stored in the cloud, to be enough for the vast majority, so I appreciate these vendors working to make passkeys more easy for the end user.

[–] [email protected] 2 points 2 days ago (1 children)

I agree and I still store my passkeys in proton pass, but that's more because there's no real option for storing them locally only. I really like passkeys and they make me optimistic about the future, it's just that I think the way they should work is that each device should have a passkey registered to an account, so that the access can then be revoked if the device was compromised. And it's even convenient in this way with the QR codes that you can use to temporarily share a passkey to then be able to add the new device.

load more comments (1 replies)
[–] [email protected] 14 points 2 days ago (1 children)

Them being portable makes them actually useful though for me, unless there was a way to use them from a phone to login to a website on a desktop/other device.

Being able to login into a password manager and use a passkey is great, passkeys need to become mainstream to get everyone away from passwords, but they can't be locked locally onto one platform or you have issues. The regular joe won't be backing them up from their iPhones or whatever.

I don't see why a local option wouldn't exist though, perhaps they will come once passkeys have matured further.

[–] [email protected] 22 points 2 days ago (2 children)

I read the post more closely and saw that this isn't about syncing the keys across password managers, it's about transfering them to a different password manager/device. In that case I'm okay with the initiative. This is to prevent lock-in and I'm all for it.

load more comments (1 replies)
[–] [email protected] 31 points 2 days ago (1 children)

I guess you're better off buying a physical security key, which offers some guarantee that the keys cannot be exflitrated from the device.

[–] [email protected] 2 points 2 days ago (2 children)

I have one, but I use it as a second factor because it does not have a way of identifying me

[–] [email protected] 21 points 2 days ago (2 children)

Strange, my Yubikey allows me to authenticate using Passkeys just fine by entering the PIN that protects my stored credentials.

load more comments (2 replies)
load more comments (1 replies)
load more comments (1 replies)
load more comments
view more: ‹ prev next ›