Hacker News new | ask | show | jobs
by throwaway09387 361 days ago
Look up passkey provider attestation. Services can't block your password manager, but they can block your passkey manager. It was used to threaten the KeePassXC devs into removing cleartext passkey exports.
2 comments

Services manage to "block" my password manager all the time by confusing it to the point where I have to copy and paste my password manually. It's a huge security risk (because where am I actually pasting this password?), and super frustrating.

EDIT: I'm not saying that the passkey situation is great, but it's not worse than passwords. It has so many benefits over passwords that we should absolutely not let perfection be the enemy of good enough!

That's incorrect. There is nothing in a passkey that identifies it as a "key from KeePassXC", so it can't be blocked.

BitWarden exports passkeys just fine as cleartext, or to be precise as a file encrypted by the user-specified passphrase. So you can then decrypt it at your leisure.

While I don't agree with the grandparent's fears, you're only half correct: The server can mandate that you use an authenticator from X company, so some sites might block KeepassXC, even if they don't block a specific key.
There is no specific attribution in Passkeys, there's AAGUID but it's allowed to be all-zero. So they actually can't block passkeys _from_ KeypassXC.

They can instead block all the passkeys, to be exact: WebAuthn credentials that are not rooted in hardware and don't have attestation.