Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many.

So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault.

And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.

So… meh. These are bugs, they will be fixed. Good on them for disclosing them. But this does not prove that passkeys are terrible. This does not make them less secure than random passwords.

If it wasn’t for the fact that they just happen to be getting passkeys, seems like this wouldn’t be worth a headline or discussing at all. And if they have this level of access, then they also get all the standard password credentials in the vault too, right?

▲

nixpulvis an hour ago | parent | next [-]

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

▲

Terr_ 40 minutes ago | parent | next [-]

The right questions. The ability to set up an alternate key in advance is functionally similar to being able to make a backup.

If I had my 'druthers:

1. You can register multiple keys, such as for different devices. Like 5-10, not two.

2. There are two categories of keys: "Regular" and "Backup/Recovery".

3. Attempting to use a Backup Recovery key prompts to user to confirm that they want to discard all regular keys and promote the backup key(s) to the new regular.

In this way, a compromised backup key can't be used secretively.

▲

BoppreH 23 minutes ago | parent | prev | next [-]

Also, can I add a backup key without having the private key with me? Ideally I would like to keep a master key in a vault, to recover compromised accounts and such, but requiring me to load the master key to create every account prevents truly secure storage.

▲

ecesena 42 minutes ago | parent | prev [-]

There’s FIDO CXF/CXP: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030...

To my understanding both Apple Passwords and the Android equivalent allow you to export passkeys to a different app (password manager), but I haven’t tried it yet.

If anyone has direct experience I appreciate to know how it was.

	▲	Gigachad 32 minutes ago \| parent \| next [-]
		I had a click around Apple Passwords on macos and I could not find a way to move my passkeys to another app. I could only see a way to share them with other Apple Passwords users.
	▲	antgiant 23 minutes ago \| parent \| prev [-]
		I can confirm it works on iOS 27. I haven’t tried elsewhere though

▲

tamimio 7 minutes ago | parent | prev [-]

> And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.

No? It’s why 2FA exists. I have an email with password of 5 characters only and the password leaked decade ago, never changed it and no one accessed it because it has 2fa. I can share my whole password vault and I would not care about it because it’s useless without 2fa. Not the case with passkey, glad I never set it up on any of my accounts, pass+mfa is good for 99% of accounts (not sms obviously), rest are public private keys.