[DyslexicAtheist]

the article mentioned passkeys as a solution but imho is only a path towards vendor lock-in.

Like, "we solve your security issue provided you do business only with us".

That is neither "antifragile" nor resilient. It's just hype.

[tiagod]

I have my passkeys in 1password and they work fine. One key for each service, I don't see the difference to normal passwords in terms of lock-in

[throwaway09387]

Look up passkey provider attestation. Services can't block your password manager, but they can block your passkey manager. It was used to threaten the KeePassXC devs into removing cleartext passkey exports.

[krupan]

Services manage to "block" my password manager all the time by confusing it to the point where I have to copy and paste my password manually. It's a huge security risk (because where am I actually pasting this password?), and super frustrating.

EDIT: I'm not saying that the passkey situation is great, but it's not worse than passwords. It has so many benefits over passwords that we should absolutely not let perfection be the enemy of good enough!

[cyberax]

That's incorrect. There is nothing in a passkey that identifies it as a "key from KeePassXC", so it can't be blocked.

BitWarden exports passkeys just fine as cleartext, or to be precise as a file encrypted by the user-specified passphrase. So you can then decrypt it at your leisure.

[stavros]

While I don't agree with the grandparent's fears, you're only half correct: The server can mandate that you use an authenticator from X company, so some sites might block KeepassXC, even if they don't block a specific key.

[cyberax]

There is no specific attribution in Passkeys, there's AAGUID but it's allowed to be all-zero. So they actually can't block passkeys _from_ KeypassXC.

They can instead block all the passkeys, to be exact: WebAuthn credentials that are not rooted in hardware and don't have attestation.

[mnahkies]

I'm probably missing something, so would be great to get a ELI5 for this.

How does storing passkeys in a password manager materially differ from the very long/strong passwords I'm already storing in my password manager? (and it's matching against the domain around autofill etc)

[krupan]

Passwords are a shared secret. You know it, and the website you are logging into knows it. If the website leaks it, someone else can log in as you.

Passkeys are a private key/public key pair. You give the public key to a website, but you don't share the private key with anyone. To log into the website, you encrypt a short message with the private key, and they can use the public key to decrypt it. If they leak the public key, it doesn't matter. Nobody can use it to log into the website. Only the private key can do that.

Also, there is a standard way of logging into a website with a passkey. The password manager can easily do it on every website. With passwords, every website is a little different. Your password manager can log in easily on some websites, and on others it can't and you need to copy and paste your password from the password manager to the website.

Besides being inconvenient, people have been able to write code that tricks password managers into thinking they are sending your password to the correct website when they are actually sending it to bad guys. Similarly, humans can be tricked into copying and pasting the password to the wrong place, giving it to bad guys. That leaks the important shared secret!

If someone tricks your password manager in a similar manner with passkeys (which is much more difficult because of the standard way password managers and websites communicate), all they get is a message encrypted with your private key. Maybe this could be used to log onto a website one time if they are very clever, but they do not get your private key which could be used to impersonate you many many times like a leaked password would.

[max1cc]

Can't be phished. With a normal password manager, user error could lead to copying credentials and pasting out to a phishing page which is irrelevant with passkeys

Autofill is a good point but it doesn't help your parent who thinks the thing is broken so they have to do it manually, rather than realising it's a phish

[tatersolid]

A passkey never exposes a secret to the website, so neither malicious scripts (e.g. via ad networks or analytics “partners”) nor malicious browser extensions can scrape the password.

Plus passkeys are inherently phishing resistant, and don’t rely on the end user being wary when autofill don’t work. Autofill doesn’t work a lot, due to broken sites blocking paste as well as stupid sites that have you enter your creds to into multiple domains. (Yes, I’m looking at you, United Airlines…)

[xxpor]

How?