1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.
I had a discussion with my mother advising her to switch: she is afraid of changing ISP because her email is tied to her provider. We fixed this on mobile years ago but email is still a goddamn mess. Moral of the story: never get locked in.
You're not locked in. Want to switch? Add a passkey. Lose all your passkeys? Do the "forgot password" thing just like you've done forever.
I'm surprised that they're moving forward with this already. As of last week, there were still enough rough edges on their implementation that I disabled it for my Workspace tenants. The two most irritating: 1. Advanced protection doesn't yet support passkeys. You must keep U2F in place for now. 2. If you have a U2F key configured on your account, Google will prompt you to use it as a passkey before telling you that…
> Android is also a problem here. Even in 14, it doesn't seem to support passwordless FIDO2 flows.
Why would they? When Passkeys provide another opportunity for Google to lock-in their customers.
1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.
Is version 8 reasonably mac-like? On 7 it's still a mac application that acts like a true mac application (drag/drop works properly everywhere, expansion, properly keyboard-enabled, etc) which is well nigh impossible when running inside a chrome box.
Agile Bits support kept insisting it was the same as the old native app and people kept complaining about bugs until I stopped following it.
1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.
Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys.
Re. your point about 1Password going down: Your passwords and passkeys are all stored locally when they sync to your devices. If 1Password becomes unreachable for any reason, you still have access to everything in your vaults, you just can't sync between devices any more.
1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV. That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.
This is a quibble, but if 1password goes down, your vaults still exist on all your devices and the app will keep working, it's only the syncing of modifications between devices that won't work.
While I believe this is a step in the right direction. I have read too many horror stories of people who were locked out of their Google and iCloud accounts with no real possibility of getting back in. I don’t think I am alone in thinking I am on borrowed time. Someday, probably due to my own fault I will be locked out of Google and my digital life will be over. If a private company can offer a similar login method l…
"You might get locked out of your account" is the updated version of the old "Your hard drive will crash." It isn't a matter of if, it's just a matter of when. Backups and a thorough disaster recovery plan is absolutely mandatory for anyone who cares about their data. Some company is going to mess something up due to no fault of your own. It is inevitable. Unfortunately, there aren't good disaster recovery options fo…
My thought on this is to involve notaries. As in you can get a notorised account. And if something goes wrong you can get a notary in the loop and by law the providers have to fix what ever has gone wrong or they are liable for actual and statutory damages.
I don't know how Google solved this, but it's an old solution. Shamir secret sharing. You break apart your keys into M pieces, where you need N pieces to reconstruct the key, so let's say 3/8. Then you need 3 pieces out of the 8 pieces it's broken into to recover your key. You take each of those 8 pieces and give to trusted sources. When you need to reconstruct your key, you have at least 3 of those give you the key…
I had the same idea about a decade ago but never bothered to try to implement it. I felt like it would have suffered from the same problem all other technologies have in security: overly complex user interactions. The concept makes sense, but getting N other people to commit is overhead the average user probably doesn't want to deal with.
So I preferred the idea of regular folks for backup, for security reasons. I thought of the idea of professional users like say your bank or 3rd party. The issue is that it's far easier for the govt to subpoena those pro 3rd parties and recover your key. Whereas, they would have to know which of your friends you used for key recovery to be able to do that. The idea was to make it tough for a bad/powerful actor to steal your key. Of course, the challenge is that a non social person would need friends or to depend on ISPs, banks (pro 3rd party providers). My goal besides security when building this project was to break the chain of 3rd party auths (Google, MS, Github, etc) :-(. They use their auth as a way to lock folks into their ecosystem and if you offend them in anyway, you could lose access to everything. Offend Google on adsense and lose your personal photos/email. Offend Amazon on sales and lose your prime streaming/AWS access. Hopefully as the idea picks up, the monopolistic corps can be tackled again to remove such power.