Hacker News new | ask | show | jobs
by wbl 239 days ago
That's the whole point of this exercise. If export is possible it's not secure against local compromise in the way that's needed.
3 comments

The point of passkeys is to protect against phishing and password reuse. You can't protect against local compromise, even if your passkeys are stored in something like a YubiKey, because once you log in to your bank with your hardware-backed passkey, the malware on your computer could use the session you started to transfer all of your money out of your account.
That’s why most banks ask you to approve transactions with an explicit reauthentication.
Then the malware will just wait until you want to do something legitimate that needs that, and then swap it out for its own thing.
But it can't maintain that compromise. That's important.
That's not quite correct. This can easily be seen by simply considering that the people who developed the passkey standard are also developing a passkey import/export standard which is nearly done and implementations are appearing in the field already.

For example Apple's Passwords app on MacOS/iOS/iPadOS 26 now supports export and import of passkeys to/from other apps that support that standard. I don't know if any other apps have yet actually released such support.

Needed for whom? As others have said, without export it's a recipe for vendor lock-in.
lock-in to which vendor?

Passkeys support transfer to any vendor you want.

Can you send some documentation on how? For example, I tried googling for transferring a passkey out of popular systems and it doesn't seem possible[1][2] other than through JSON export[3] which is what some sites want to block as I understand.

[1] https://old.reddit.com/r/Bitwarden/comments/1efs5d2/how_can_...

[2] https://old.reddit.com/r/Bitwarden/comments/1di8nbz/import_p...

[3] https://news.ycombinator.com/item?id=44454106

I don't think you're going to find it. The main vendors are hostile to this workflow. I get why, any flow that can exist to export passkeys can be used by hostile actors to walk a 75-year old millionaire grandma through handing over $$$. I think however that that's just a risk we have to make the bank and brokerages accept. It's not a problem with a technical solution.
Why is it more important than protecting users? They've already added a way to share them securely.
Wasn't the discussion you responded to about how they currently can't be shared and that the vendors don't want them to be shared as it breaks their desired lock-in?
I want to transfer them to a vendor that will let me export them in plain text.
Is it really "any" vendor, or is it just the big ones? Can you transfer your Apple passkeys to KeePassXC?
I can't even find documentation on how to do the simplest transfer, from Apple iCloud Keychain to Google Chrome or vice versa.
Not yet. Apple supports export using FIDO's Credential Exchange standard. KeePassXC is working on adding that.