Passkeys now support external providers
developer.apple.com
Passkeys now support external providers
1–10 of 185 posts
Re: Passkeys now support external providers
#2Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17...
This is big news as vendor lock in and inability to use our own sync was one of the biggest issues bought up whenever Passkeys are discussed. Apple are now allowing external sync fabrics such as password managers.
Re: Passkeys now support external providers
#3This is a smart move by Apple. Authentication infrastructure is necessarily cross platform. It doesn’t generate revenue for Apple, but the lack of cross platform auth would limit enterprise adoption of Apple products.
Re: Passkeys now support external providers
#4There is only this blurb to go on at the moment:
"Passkeys can now be synced using external providers..."
so it's hard to say exactly what it will mean for user control and choice. Which external providers? Will users be able to access and store their own private keys in compatible apps of their choosing? If so, aren't we largely back to passwords?
Re: Passkeys now support external providers
#5Interesting, but can someone tell us what this implies wrt. authorities? If someone gets your iPhone and forces you to press your finger on the TouchID, he gets all your passwords no? While with a general master password you could just pretend to have forgotten it?
Re: Passkeys now support external providers
#6That's a great development. Reducing vendor lock-in removes one of the bigger reservations some mentioned in regards to WebAuthn.
Re: Passkeys now support external providers
#7This is a smart move by Apple. Authentication infrastructure is necessarily cross platform. It doesn’t generate revenue for Apple, but the lack of cross platform auth would limit enterprise adoption of Apple products.
Passkeys (otherwise known as WebAuthn) isn’t an Apple specific standard though.
Re: Passkeys now support external providers
#8There is only this blurb to go on at the moment: "Passkeys can now be synced using external providers..." so it's hard to say exactly what it will mean for user control and choice. Which external providers? Will users be able to access and store their own private keys in compatible apps of their choosing? If so, aren't we largely back to passwords?
> aren't we largely back to passwords?
A password is a shared secret. Even if it's hashed on the server side, one could brute force it if a weak algorithm is used, or MiTM the service to get the plaintext when the user logs in.
Passkeys / webauthn utilizes public key cryptography. I'm only ever giving them a (by the spec, unique to the combo of me and the site in question) public key to which I hold the private key pair.
Authentication doesn't involve transmission of these, it's challenge based where you prove you have access to the corresponding private key.
Re: Passkeys now support external providers
#9That's great to see! I just tried out 1Password's beta browser extension which has passkeys support, and the UX is super seamless. Played around with it on https://www.passkeys.io/
I'm really hopeful about this, a lot more than any of the previous iterations of the FIDO stuff. I worked at a company that was an early adopter/implementer of the original FIDO U2F spec, and it had major UX problems, enough that I couldn't see it ever being used by the general public (who the heck would carry a USB key with them?? and this only works with desktops/laptops, sure Bluetooth support, but ehhh), but with this, synced to your password manager of choice, that's A LOT better.
The passkey is usable anywhere (signed up on my desktop, hopped over to my laptop and signed in there with the same passkey). I can't use it from my Android phone yet, but that will come soon I'm sure when 1Password adds support to the mobile apps + Google does the same as Apple here with adding proper Android integration.
On Android I can still only use a USB/NFC/Bluetooth security key, or "my lock screen" (i.e. on-device security key, not passkeys) so far. If I click on "Sign in with a passkey" it says I have no passkeys via an Android system dialog, but if I sign in with my email it lets me use my "security key" (i.e. biometric lock screen prompt).
Re: Passkeys now support external providers
#10Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits:
> Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak.
> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers.
> Safe from phishing. Passkeys are intrinsically linked with the app or website they were created for, so people can never be tricked into using their passkey to sign in to a fraudulent app or website.