| ▲ | blackcatsec 2 hours ago |
| Definitely not wrong here. It is a confusing mess for most people. Thankfully, for folks all in on the Apple ecosystem, it should be pretty decent of an experience. Everyone else? not so much. |
|
| ▲ | gumby271 2 hours ago | parent | next [-] |
| I think this is exactly the "Passkeys are a trap" argument though right? If you lock yourself into a single vendor, everything is easy and beautiful. If you choose a diverse set of vendors, it sucks so much more than passwords and password managers ever did. |
| |
| ▲ | willis936 2 hours ago | parent | next [-] | | Keepassxc and strongbox passkey integrations seem pretty good on all of the OSes and browsers I've used. I think passkeys make a messy credential situation even messier, but make a tidy credential situation even tidier. | | |
| ▲ | marcosdumay 2 hours ago | parent | next [-] | | Good thing the FIDO group is already trying to block key synchronization with keypass and other open source managers... | |
| ▲ | warkdarrior 2 hours ago | parent | prev [-] | | > Keepassxc and strongbox passkey integrations Isn't that a single vendor (or two)? How is this not lock-in? | | |
| ▲ | Banditoz 2 hours ago | parent | next [-] | | KeepassXC at least allows you to export your passkeys should you choose. The people behind passkeys do not like this. https://github.com/keepassxreboot/keepassxc/issues/10407 | | |
| ▲ | dwaite an hour ago | parent | next [-] | | Which changed to KeepassXC looking to support the standarization work to allow passkeys to be moved between user-controlled software products. The complaint wasn't in allowing credentials to move (that is the point of the CXF and CXP work). The complaint was in having sensitive data in a plaintext file live long-term without any protections. That is also why one of Tim's early recommendations was to require encrypting the file via a passphrase. | |
| ▲ | ylk 2 hours ago | parent | prev | next [-] | | This is not accurate. The very first sentence of that issue is: > Passkeys should never be allowed to be exported in clear text. and from another comment by the issue creator: > I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here. They're arguing for storing them in encrypted form. That's very much a different argument than arguing against exporting. I'm not taking any sides here, I just think it's bad to so badly misrepresent people's standpoints. | | |
| ▲ | Banditoz 2 hours ago | parent [-] | | The kdbx format is encrypted on-disk. You need a password to decrypt the database. | | |
| ▲ | dwaite an hour ago | parent [-] | | That isn't what is being discussed by the issue. The issue was pertaining to an unencrypted export. |
|
| |
| ▲ | timmyc123 2 hours ago | parent | prev [-] | | Asking that services require you to encrypt your backup file by default to protect against local malware or malicious access is certainly not "The people behind passkeys do not like...allowing you to export your passkeys". | | |
| ▲ | Banditoz 2 hours ago | parent | next [-] | | keepassxreboot/keepassxc#10407 [Passkeys] should never be exported in clear text
Overview
Passkeys should never be allowed to be exported in clear text.
[...]
I suppose we have different interpretations of the headline. | |
| ▲ | timmyc123 2 hours ago | parent | prev [-] | | maybe read the whole issue? |
|
| |
| ▲ | Gander5739 2 hours ago | parent | prev | next [-] | | Well, KeePass is self-hosted, and I hadn't heard of strongbox before, but it says on the website: > Store your data anywhere you like, online or offline. Sync with every major cloud storage provider or your own server over WebDAV or SFTP. Use your Strongbox database with any KeePass compatible client on any platform. | |
| ▲ | willis936 2 hours ago | parent | prev [-] | | I use nextcloud to sync my own keepass database across my devices. Both nextcloud and keepassxc are open source. Please explain how self hosting open source software is locking me into a vendor. If the sky falls and strongbox ceases working with mac/iOS I can use android and linux. Nobody is locking my lockbox. |
|
| |
| ▲ | watermelon0 2 hours ago | parent | prev | next [-] | | On iOS devices you can import/export Passkeys between supporting password manager apps (including Apple Passwords). In my experience, migrating between Apple Passwords and Bitwarden worked without issues, in both directions. | | |
| ▲ | dd8601fn 2 hours ago | parent | next [-] | | Wasn’t part of the point of the last article that some of the various methods we call “passkeys” aren’t portable? | | |
| ▲ | dwaite an hour ago | parent [-] | | Generally, if you want to restrict the user to use a particular authenticator, you need to own that authenticator. At that point you can have the attestation you are looking for. If you want Yubikey policy and behavior, you're gonna have to get your user a Yubikey. The passkey provider vendors are motivated to serve their customer's needs (the end users, and secondarily enterprise deployments) over non-customer needs. So Apple platform support (for example) will only send an attestation when one is configured via MDM. Your provisioned work device can indicate to work systems that it is in policy. The compatibility-limiting risk, if it exists, is more likely from regulators putting their hands on the scale and pushing for security policies that would prevent synchronization and backup, and requiring attestations to make sure those policies are in effect. |
| |
| ▲ | gumby271 2 hours ago | parent | prev [-] | | I'm not saying it's impossible, I'm saying there's a barrier that's useful to further vendor lock in. My mom is going to use Apple passwords on her iPhone. When she needs a new phone, the complexity of import/export and fear of losing access to her accounts is going to push her to buying another iPhone. It's just another avenue of lock in, like existing OS level password managers, just with an extra level of confusion for the end user. |
| |
| ▲ | phoghed 2 hours ago | parent | prev | next [-] | | brother I locked myself in long before the passkey showed up | | |
| ▲ | gumby271 2 hours ago | parent [-] | | I mean yeah, customer lock in has been Apple's business model for a long ass time, that's not surprising. | | |
| ▲ | rootusrootus 2 hours ago | parent [-] | | Mostly, though, it is not true lock-in, as in they mostly don't force you to do things their way. They encourage it, make the features pretty seamless to use, etc, so that you want to stay in their system, but they generally permit you to use whatever tools you want. | | |
| ▲ | xigoi 2 hours ago | parent | next [-] | | On an iPad/iPhone, you are not allowed to install apps not approved by Apple. | |
| ▲ | gumby271 2 hours ago | parent | prev [-] | | Agreed, it's the bare minimum to keep them out of trouble usually. |
|
|
| |
| ▲ | MBCook 2 hours ago | parent | prev | next [-] | | The fact that the password manager someone might use on another system is a complete piece of crap does not mean passkeys are an Apple lock-in attempt. There are an open standard. You just have terrible software. | | |
| ▲ | gumby271 2 hours ago | parent | next [-] | | My issue isn't with the standard, but if all implementations lead to the same shitty experience of 3 different apps begging to store and use my passkeys, then something isn't working right. In my case, the terrible software is Apple's Mac OS, Google's Chrome and/or Firefox, and sometimes Bitwarden still acting weird. Lets not even get into how wild Windows acts when a passkey shows up. Saying it's an open standard, and that it's just all the major players I'm forced to interact with that make it suck isn't very helpful. That's like the people that say "Don't like iOS? Build your own successful mobile OS lol" | | |
| ▲ | MBCook an hour ago | parent [-] | | I’m not saying built your own mobile OS. I’m sorry you have multiple pieces of software that want to be in charge, but aren’t passwords the same? Because Chrome and Firefox both want me to use them for my passwords. It’s not a problem unique to Passkeys. It’s just everyone ignoring user preferences to try to score stickiness. |
| |
| ▲ | xigoi 2 hours ago | parent | prev | next [-] | | As the previous article says, some passkeys are open, while others require lock-in, and megacorporations deliberately create confusion between the two. | | |
| ▲ | MBCook an hour ago | parent [-] | | What lock in? The attention this article debunks and no one uses? |
| |
| ▲ | 2 hours ago | parent | prev [-] | | [deleted] |
| |
| ▲ | iAMkenough 2 hours ago | parent | prev [-] | | If that's the argument, it's bull. If you use Apple hardware, you're not locked in and required to use Apple's default Passwords manager. Microsoft Authenticator, Bitwarden, 1Password, etc. all support storing passkeys and support multiple hardware platforms. It's no different than making your own decision on which password manager you want to use. |
|
|
| ▲ | OkCompute64 2 hours ago | parent | prev | next [-] |
| As a Bitwarden (and Vaultwarden) user on Mac/iOS/Safari, Linux/Firefox and Android I have had zero issues with passkeys since I started using them a few years ago. The first two accounts I switched over to passkeys were my Nintendo and Playstation Accounts as it made sign-in much smoother. I now use passkeys pretty much everywhere I have the option (at least on high value accounts such as Amazon) and I have not once had an issue. Not having to use a TOTP (or worse an SMS or email based one use code/link!) is much nicer in my personal opinion. Some sites have a much better designed on-boarding process than others I 100% agree there. I find the sites that do a poor job with their passkey enrolment are the same sites that also did a terrible job of 2FA/MFA setup as well though. One blessing with passkeys is since I set it up for my mother with her Amazon account she has not once had to ask me to help me reset her password. At least once every 6 months I would have to help her sort things our as she would forget it, reset it and then forget what she reset it to and can't reset it again as she hadn't clicked to update the password in her password manager so it had an old or incorrect password, etc. Always a pain to sort out. Not happened once since switching her to a passkey which is wonderful for me. Also it is essentially impossible for her to use the passkey on a fake site. Multiple times she has fallen for phishing emails with realistic looking site logins and she would just blindly enter her username and password as many elderly people do. |
|
| ▲ | throwitaway222 2 hours ago | parent | prev | next [-] |
| Both of my systems are apple, one has a Work Apple account and one has a Home apple account. How do I log into website X with 1 identity WITH FIREFOX? (people are going to jump through hoops when they find out my work laptop blocks mozilla services when I can just use a TOTP token on my phone and everything works.) |
| |
| ▲ | dwaite an hour ago | parent [-] | | I think Firefox had system integration with the password/passkey provider framework since 122. If you do not have access to your personal Apple account on your work laptop, you would need to find some other passkey provider with native integration. Under Settings > Privacy and Security, look to see that Firefox is listed and has access under "Passkeys access for Web Browsers". Unlike a native app which only needs passkeys for its own services, Firefox needs access for every potential service you might hit over the internet. Then under General -> Autofill and Passwords, you'll see any apps which are registered as system password managers. Unfortunately this is a subset of the ones which register on iOS and I'm not familiar who has done integration yet in their Mac release - Chrome (with GPM) for instance is not listed even though it is available on iOS. |
|
|
| ▲ | blueplanet200 2 hours ago | parent | prev | next [-] |
| >Thankfully, for folks all in on the Apple ecosystem, it should be pretty decent of an experience. How many people are for now and forever more all in on the Apple ecosystem. You never have to login on another non Apple device ever? |
| |
| ▲ | rootusrootus 2 hours ago | parent [-] | | Step away from HN, and there are probably a lot of people who only use their phone to access the Internet. Smartphone brand loyalty seems to be strong, too. |
|
|
| ▲ | madeofpalk 2 hours ago | parent | prev | next [-] |
| I use 1Password to sync all my passkeys between iPhone, Mac, and Windows. It works exceptionally well! |
| |
| ▲ | rootusrootus 2 hours ago | parent [-] | | Same here. My only nitpick is that I have to carefully go through the various machines and browsers, etc, and ensure that only 1Password is ever consulted for password storage. |
|
|
| ▲ | croes 2 hours ago | parent | prev [-] |
| But you can’t simply switch to Android without recreating every single passkey. Sounds like vendor lock-in to me |
| |
| ▲ | alwillis 20 minutes ago | parent | next [-] | | > But you can’t simply switch to Android without recreating every single passkey. Sounds like vendor lock-in to me Not so fast. Migrating passkeys from iOS to Android is possible now; migrating from Android to iOS is still being worked on. Ricky Mondello's team at Apple created the Passwords app which brought passkeys to iOS, macOS, etc. The entire presentation is worth watching if you’re interested in passkeys; the the clip below starts at 24:00 mark where they talk about migrating between platforms. Starting with iOS 26.5, you can choose to move passkeys and passwords
from Apple Passwords to Google Password Manager. However, Android still
needed "a future update" to receive them. That same update is meant to
add transfers from Android back to iPhone [1].
The FIDO Alliance created a specification in 2024 called Credential Exchange Format [2] for moving credentials including passkeys, between passkey managers on the same device and across platforms.In other words, being able to move passkeys between devices and platforms has always been part of the plan. [1]: https://youtu.be/yVadD-Lfrfk?t=1454 [2]: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030... | |
| ▲ | madeofpalk 2 hours ago | parent | prev | next [-] | | Yes you can. You can export your passkeys and then import them into whatever android password manager, or 1Password. | | |
| ▲ | ipsento606 2 hours ago | parent | next [-] | | I was under the impression that most credential managers won't allow you to export a passkey to a plain text format, but will only allow limited app-to-app transfer of keys (with a limited selection of compatible apps only) | |
| ▲ | croes an hour ago | parent | prev [-] | | I want to import them in Android nit another app and you can export to an Android app only to another app on your iPhone |
| |
| ▲ | Onavo 2 hours ago | parent | prev [-] | | Well designed platforms and auth frameworks allow adding multiple passkeys. The problem is this requirement was never coded into the passkey standard. | | |
| ▲ | al_borland 2 hours ago | parent [-] | | That still requires recreating every passkey, even if both can exist at once. If I want 50 sites to use a passkey on macOS and Linux, I need to go through the setup process 100 times, and all 50 sites will likely handle it slightly differently. It also requires foresight if switching. I ran into this with 2FA as well. When I got a new phone, after setup it offered to wipe the old one, I declined. When I went to open my 2FA app for work on the new phone, it needed to be setup. I needed the 2FA on my old phone to login to the portal and setup the new phone. Had I wiped my old phone when prompted, I would have been locked out and on the phone with the help desk. This same scenario can happen with Passkeys. |
|
|