Viewing profile — timmyc123

Still taking feedback and questions for an upcoming consumer centric "What's a passkey?" site. https://forms.gle/wmaydkzmUp2eKfJG7 Original post: https://news.ycombinator.com/item?…

You can use any credential manager you choose for Microsoft Account passkey.

https://mobileidworld.com/apple-introduces-cross-platform-pa... https://support.google.com/chrome/answer/13068232?hl=en&co=G... https://1password.com/blog/import-autofill-organize-…

We’re building an interactive resource to demystify passkeys for both the general public and more technical users. We’re aggregating questions to ensure our FAQ and interactive gui…

> The essay has a condescending attitude towards the normie computer user who can't possibly be expected to know, but it's precisely the normie computer user who would never get th…

You can use any credential manager you choose. It is an open ecosystem. If you don't want to use a cloud service, don't. You can self-host many credential managers. There are also …

Hey I'm the guy you're talking about. Always easy to crap on people when you selectively quote what they said. The core pieces you left out are: > I don't quite understand why requ…

> Too bad the spec is stupid and requires password managers to be identifiable so servers can deny the "insecure ones". There is no requirement that credential managers identify th…

Not sure what you mean. In most cases, passkeys sync across your devices.

> stored on a YubiKey/Secure Enclave/TPM and that was what made them resident. Stored in an authenticator/credential manager in general, not specific to a security key, secure encl…

Not really. The attestation model defined for workforce (enterprise) credential managers/authenticators doesn't really work in practice for consumer credential managers.

A passkey is a discoverable credential (aka resident key) in spec terminology. But the type of credential has no relationship to attestation (which is not used in the consumer pass…

The dialog provided by the browser or OS usually tells you where the passkey is saved.

Copy and paste in clear text? Yes, I don't think that's a good idea. Download to disk in clear text? Yes, I don't think that's a good idea. Years and years of security incidents wi…

If a website were to attempt to do this, you (or your credential manager) could simply change the AAGUID to match another credential manager.

Attestation is not used in the consumer passkey ecosystem.

Hi, Tim Cappalli here. Not sure how stating that my (an individual) opinions on a topic are evolving is interpreted as "threatened the KeypassXC developers". If you've been followi…

This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a …

> it’s discouraged Why do you say that? There are billions of synced passkeys being used by users with some of the largest sites and services in the world.

Not exactly. For example, the default credential manager on Android is Google Password Manager, which works on Windows, macOS, iOS, and Ubuntu. There are also dozens of other third…

I used the technical name for the capability, but you've likely run into it before. If there is no passkey on the local device, a QR code will appear which you can scan with your p…

Unclear how this quoted comment relates to what I was replying to (which was about exporting / backing up your credentials). But I'll respond. > Will I always be able to use any cr…