Apparently these are unsupported on Linux? When I try to use my brand new Yubikey 5 Nano with Chrome or Firefox on the webauthn.io demo, it works great. However when I try on passkeys.io, it just hangs at the "You can connect and authorize [a security key] now" prompt.
Understanding Passkeys
11–20 of 79 posts
Re: Understanding Passkeys
#12Is there any company actually providing anything resembling emergency access for Passkeys? A critical feature of password vaults for me is the ability of my heirs to get access to my passwords when I am incapacitated or dead. I can't print out my passkeys and store them in a safe, nor does there appear to be any system for allowing someone access to my passkeys. Features like this seem like table-stakes to me: https:…
At least with 1Password an export contains Passkeys, and Safari team has indicated the same will be available.
Re: Understanding Passkeys
#13Apparently these are unsupported on Linux? When I try to use my brand new Yubikey 5 Nano with Chrome or Firefox on the webauthn.io demo, it works great. However when I try on passkeys.io, it just hangs at the "You can connect and authorize [a security key] now" prompt.
I've been working on passkeys for about a year now, and from my experience passkey support is fairly inconsistent. Every website+browser+OS combination can do things slightly differently or ask for a different set of features from the authenticator (some require PIN support, some require certain flags, etc), so the experience can be a bit buggy. I imagine that as passkeys get more common the support from authenticators and platforms will improve as it becomes more standardized.
Re: Understanding Passkeys
#14Is it the _goal_ of FIDO to get rid of passwords? If it is, I am against this industry group. Passwords should always be kept as a valid authentication method. The OP brings up a point about not having access to the private key... I agree with that. If I don't have access to the private key (like I currently do with ssh) then it's dead in the water to me.
With passkeys the private keys are accessible.
They have to be, because they need to be synced across devices. The OS will try to protect these keys by putting them in a protected process, with all kinds of safeguards. But in the end, the private keys will still be available.
FIDO also supports device authenticators, where the private key (by design) never leaves the hardware. These devices can be used for the true 2FA.
Re: Understanding Passkeys
#15Just because this is a common misunderstanding of passkeys, I'm going to state it again here: passkeys don't have to be locked to a hardware chip inside your device in order to work. It is entirely possible to have use passkeys only in software (shameless plug to the passkey manager I'm building, https://bulwark.id ), and that is most likely the way that most people will interact with them. I think it's unfortunate t…
Where did you get the idea that Apple and Google's implementations are hardware-bound?
Re: Understanding Passkeys
#16Just because this is a common misunderstanding of passkeys, I'm going to state it again here: passkeys don't have to be locked to a hardware chip inside your device in order to work. It is entirely possible to have use passkeys only in software (shameless plug to the passkey manager I'm building, https://bulwark.id ), and that is most likely the way that most people will interact with them. I think it's unfortunate t…
Last time I looked into your implementation, it looks very neat, but I would like to store each passkey to a file and encrypt with GPG. I use https://www.passwordstore.org/ like mechanism to store all my passwords.
Re: Understanding Passkeys
#17> The Client Device should sign the sent public key with its own Attestation Certificate. The certificate is used to attest to the manufacturer and its capabilities.
A nitpick: should is a value judgment here. Quite a few of us would rather they do not, to avoid websites taking advantage of this to require specific proprietary hardware to authenticate.
Thankfully my understanding is that Apple's passkeys do not provide attestation, which is likely to make this kind of hardware requirement uncommon.
Re: Understanding Passkeys
#18Is there any company actually providing anything resembling emergency access for Passkeys? A critical feature of password vaults for me is the ability of my heirs to get access to my passwords when I am incapacitated or dead. I can't print out my passkeys and store them in a safe, nor does there appear to be any system for allowing someone access to my passkeys. Features like this seem like table-stakes to me: https:…
> I can't print out my passkeys and store them in a safe, nor does there appear to be any system for allowing someone access to my passkeys.
Recovery is handled differently depending on who you are using to sync your passkeys. Apple has a great recovery story. iCloud Keychain supports both a "recovery key" and "recovery contacts".
See the section titled "Recovery security" in the "About the security of passkeys" doc: https://support.apple.com/en-us/HT213305
Additional relevant docs:
Recovery contact: https://support.apple.com/en-us/HT212513
Recovery key: https://support.apple.com/en-us/HT208072
Re: Understanding Passkeys
#19TLDR; version:
1. With passkeys/WebAuthn you simply use private keys to authenticate. Almost exactly like with SSH keys, except that the keys are site-specific.
2. WebAuthn supports using hardware devices for 2FA, where the private key never leaves the authenticator device.
3. Passkeys are not like this. With passkeys, the private keys are managed by the OS and are synced across multiple devices. The OS has direct access to them, and so it's possible to extract these keys and do whatever you want with them.
Re: Understanding Passkeys
#20Just because this is a common misunderstanding of passkeys, I'm going to state it again here: passkeys don't have to be locked to a hardware chip inside your device in order to work. It is entirely possible to have use passkeys only in software (shameless plug to the passkey manager I'm building, https://bulwark.id ), and that is most likely the way that most people will interact with them. I think it's unfortunate t…
Where did you get the idea that Apple and Google's implementations are hardware-bound?
Generally, the idea is that the private keys are stored on a TPM chip so they cannot be exported for security reasons, similar to a YubiKey or a crypto wallet. I know Apple and Google are looking into trying to allow users to somehow export these keys elsewhere, but I'm uncertain how easy that will be or what tradeoffs there will be. I'm skeptical that Apple and Google will try to make it too easy since they benefit from user lock-in, but I would be happy to be proven wrong.