I have my passkeys in my keepass file in my private cloud since about 6month using strongbox on iOS and KeepassXC on Linux. Sadly, not many websites support passkeys on firefox for linux desktop yet… Hope this helps!
this post was submitted on 14 Oct 2024
483 points (99.8% liked)
Privacy
31609 readers
432 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 4 years ago
MODERATORS
Lol, I'm a semi-noob and this sentence is really intimating.
Keepass is a style of encrypted file with a list of the passwords and the syntax is standardised. There are many apps/programs for any platform that offer pw management based on that file. I use keepassXC app on linux and strongbox on iOS since both of them are well integrated into the operating systems. On ios i use the webDav protocol to sync the keepass file on my server with strongbox app. On Linux I use nextcloud sync to mount my files on the server into linux and in keepassXC I have set it to automatically grab that keepass file on boot. Ah of course the keypass file is protected by a strong password, but this could as well be a hardware token like a yubikey. But if you have a yubikey, you just store your passkeys on that😂
Seems like people in the comments are misunderstaning the announcement entirely. This protocol is about import and export from password managers and not about having them synced between devices. It would prevent a lock in effect. This is a great development!
FIDO Alliance’s draft specifications – Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) – define a standard format for transferring credentials in a credential manager including passwords, passkeys and more to another provider in a manner that ensures transfer are not made in the clear and are secure by default.
Lock in effect of passkeys is just infuriating 😂good to see progress!
I personally like it. Imo passkeys should optimally be device bound and the private keys should be stored in TPM or equivalent and be non-exportable.
Well, nothing is stopping you to keep passkeys only in one place, why force others to do what you like? Now we have options and less friction to switch to a competitor. Which results in more competition and that results in better products. Well theoretically..
I just don't think synced passkeys should be the default for example iOS.
What Microsoft is doing with device-bound passkeys using Windows Hello is imo great.
When most sites refer to passkeys, they're typically talking about the software-backed kind that are stored in password managers or browsers. There are still device-bound passkeys though. Also since they're just FIDO/WebAuthn credentials under the hood, you can still use hardware-backed systems to store them if you really want.
While you're right that device bound and non-exportable would be best from a security standpoint, there needs to be sufficient adoption of the tech by sites for it to be usable at all and sufficient adoption requires users to have options that have less friction/cost associated with them, like browser and password-manager based ones.
Looking at it through the lens of replacing passwords instead of building the absolutely highest-security system helps explain why they're not limited to device-bound anymore.
Why is the buzz around passkeys is back? I am seeing them way more often than they used to be. I think I have created passkeys for 2 apps and don't even know how that worked, it such a breeze that almost felt it wasn't secure lol.
In what ways the passkeys are different than authenticator apps?
Passkeys are meant to replace password-based login whereas TOTP apps are only meant as a 2FA method.
Convenience and security.
Authenticator apps are still vulnerable to phishing, passkeys are not.
With the ability to transfer passkeys, the attack vector phishing does not sound that far fetched. Tho i have not looked into the transfer process.
We will see i guess.
Idk, a SSH-Key is also transferrable, yet it's still safe
And given that Passkeys are essentially specialized ssh-keys, I don't see the Problem.
But I'd like to know it I'm wrong.
Why do you think SSH-Keys are safe against phishing? I mean it is unlikely, that someone will just send the key per mail or upload it somewhere since most ppl using SSH-Keys are more knowledgeable.
When you now get an easy one click solution to transfer Passkeys from one Cloud provider to another it will get easier to trick a user to do that. Scenario: You get a mail from Microsoft that there is a thread and that you need to transfer your keys to their cloud.
The thing is, that you only have to share public keys and never private ones. So you can only phish public keys…
You share public keys when registering the passkey on a third party service, but for the portability of the keys to other password managers (what the article is about) the private ones do need to be transferred (that's the whole point of making them portable).
I think the phishing concerns are about attackers using this new portability feature to get a user (via phishing / social engineering) to export/move their passkeys to the attacker's store. The point is that portability shouldn't be so user-friendly / transparent that it becomes exploitable.
That said, I don't know if this new protocol makes things THAT easy to port (probably not?).
Well, they made it very secure with the transfer of passwords /s
It felt so strange having a CSV file with all my passwords and 2FA secrets in plain text in my downloads folder..
Imagine if would not have used a encrypted partition, my passwords may still be on that disk…
The thing is, that you only have to share public keys and never private ones. So you can only phish public keys…
How would you sync or transfer a passkey across devices without transferring the private key?
That’s July question: the article even points that out. If previously the private key was in hardware, never exposed, but now it has to be available to software. Does it open any potential attacks?
Even if it is less secure, this is probably a good thing to prevent vendor lock-in. I know that’s one reason I rarely use passkeys
Yea, I strictly did not set up any passkeys until I got strongbox pro, to store it outside of apple walled garden. To get 2FA secrets was hard enough (had long time no macOS device, only iOS)
That was a rhetorical question towards the commenter since the discussion point was not understood.
I read it again and agree 😂
I don't like that passkeys are portable, this kind of defeats the entire purpose. The way they were sold to me is the following: it's 2 factors in one. The first is the actual device where the key lives, and the second, the user verification, like a pin, face scan, fingerprint etc. If it's synced across the cloud, there's no longer the first factor being the unique key on the unique device.
Granted, passkeys even without the first factor are still magnitudes better in terms of convenience and security compared to passwords, but it just disappoints me a little that there are no good options to save passkeys on my local device only, with no cloud sync.
If anyone knows of a local-only passkey manager app for android, as well as the same as a firefox extension, I'd love to know about it!
If you don't want to sync your credentials with a server, why are you using a server based credential manager?
load more comments
(2 replies)
I guess you're better off buying a physical security key, which offers some guarantee that the keys cannot be exflitrated from the device.
load more comments
(5 replies)
If they're not portable how would I for example login to an account while on my Desktop, if I set up the passkey on my Phone?
You generate a second one on the other device.
Assuming that all services you log into support multiple passkeys. My auto financing company doesn’t, for example
Well, then it seems like they have not understand the idea behind passkeys, like so many..
I'd like to see some documentation that says passkeys were intended to never be synced across anything.
Everything I have ever read is that it's basically asymmetric cryptography like ssh keys. You have a private one, generate the public and give it to the site. It stops reuse of passwords and site breaches become useless as the public key is useless for attacking an account on another site, etc. (well, besides whatever data was lost in the breach which is outside the scope.)
I see no reason to limit someone having the private key on their phone, their desktop, etc. Having to generate yet another passkey for every device is inefficient and would decrease adoption of this.
Yea, ssh private keys as well are intended to only stay on Device that generated it. The idea is, that the device you want to connect to has all the puplic keys of all devices you want connect from in their known hosts directory. And you should not transfer private keys.
But of course there is always a battle between convince and security, so there were ways created to transfer encrypted private keys protected with a password.
And the same happened to passkeys.
I myself choose convenience over security in that regard and share my private keys and passkeys on my devices and thus am happy about that development.
The thing is, having options is often good, so a person should be able to choose passkeys in the secure way where you can invoke each device individually and never have the passkey to leave the device where it was generated. To achieve this, website need to allow multiple passkeys to be used, and would be expected from a bank, in my opinion. Maybe they think it is more secure to have just one passkey on one device, which it is, but how do you recover your account if that device dies?
load more comments
(4 replies)
Them being portable makes them actually useful though for me, unless there was a way to use them from a phone to login to a website on a desktop/other device.
Being able to login into a password manager and use a passkey is great, passkeys need to become mainstream to get everyone away from passwords, but they can't be locked locally onto one platform or you have issues. The regular joe won't be backing them up from their iPhones or whatever.
I don't see why a local option wouldn't exist though, perhaps they will come once passkeys have matured further.
I read the post more closely and saw that this isn't about syncing the keys across password managers, it's about transfering them to a different password manager/device. In that case I'm okay with the initiative. This is to prevent lock-in and I'm all for it.
Transferring a passkey means it has to be portable which they already are, since I have mine portable since about 6 months using a keepass file on my private cloud.
load more comments
(1 replies)
load more comments
(8 replies)
view more: next ›