[giancarlostoro]

If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it.

Linux is the only oddball here, I had issues getting this flow to work.

If the UX for Passkey improves, I will go all-in on it, I'm at the point I'd love to just completely block passwords from accessing my account, unless I explicitly enable it temporarily by logging on via passkey, I wish some sites would let me lock my account to this level, it would be better. Passwords feel like they just wind up all over the web.

Weirdly enough you can store multiple passkeys for a given domain, which can get confusing in some cases if they dont have normal names tied to them.

Edit: Originally I thought Passwords from Apple was iOS / macOS only, but its not! So I have been editing my original message, sorry for the confusion, I had forgotten that I can login on Windows with my Passkeys from Apple's ecosystem.

As another poster noted, you can transfer them out of Apple's ecosystem too!

[reddalo]

> Linux is the only oddball here, I had issues getting this flow to work.

Take a guess why.

Passkeys are just a trick for vendor lock-in disguised as a security practice.

[frizlab]

They are, however, completely unphishable, which is a big plus IMHO

[giancarlostoro]

Firefox just didn't support it cleanly, I think Chrome did, I don't remember. Apparently it's just due to Linux not having a native passkey implementation. Dang.

Edit:

Apparently BitWarden should work, but my particular passkey was not on there.

[PaulDavisThe1st]

> Apparently it's just due to Linux not having a native passkey implementation.

Excuse me? The infrastructure for "an apps is trying to login with a private/public key pair, and right now it needs the private key to encrypt some part of the transaction" has existed on Linux since it began.

The problem, as best as I can understand it, is that some/all browsers are not treating passkeys as an extension of the key system that began with ssh(1), even though technically speaking, they are.

[ghostly_s]

I use Bitwarden on Linux. There is no option to do anything with a passkey I have stored there except delete it.

[throwawayffffas]

Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication.

If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.

[kbelder]

I don't think that's the unpopular opinion, I think that's the standard opinion, outside of the corporate security cloister.

[giancarlostoro]

It is not Apple's job to implement Passkey into Linux, that is up to the Linux community to build up and figure out, and then for Firefox to implement it on Linux. On the other hand, Chrome just works with it, so maybe Firefox either implements it for Linux in-house, or figures out an existing initiative they could invest resources towards and help to prop up so they can integrate against it on Linux.

[throwawayffffas]

My issue is not the lack of Linux support, my issue is the dependence on hardware components, that are distributed by a small group of incumbents, that is pretty much baked into the spec.

What they want is to lock your identity to your android and/or iphone devices.

[moi2388]

What are you talking about? I can literally export all that data to another OS or password manager. Takes a whopping single click.

[debazel]

Only to other proprietary systems within the FIDO Alliance that you don't own or control.

Additionally passkeys allow services to detect and ban specific password managers, so have fun when the only approved managers that works consistently across all services are Google/Apple/Microsoft. There is already a list of "bad" clients here https://passkeys.dev/docs/reference/known-issues/

[moi2388]

Again, what are you taking about? There are open source implementations available. I can write my own. They do work. This list just shows some which do not actually implement the spec correctly.

Also moving the goalpost. The post I replied to said I couldn’t export it. I absolutely can, and have, with a single click. To another provider. It’s really not a big deal.

[pseudalopex]

> This list just shows some which do not actually implement the spec correctly.

KeepassXC was threatened to be blocked.[1]

[1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

[moi2388]

Because they were exporting secrets in plain text. And they didn’t threaten, they said relying partners (so the site itself, for example GitHub) might block them.

This is not some conspiracy, and again has nothing to do with the fact that I can export my key passes

I don’t get the activism here

[giancarlostoro]

I didn't realize this was supported, I'm kind of favoring Apple's Passwords app since you can lockdown your account and they are very on top of someone accessing anything of yours. Any time I power on an iPad I havent used for months they tell me a new device can read my texts type of thing, which is a nice paper trail.

[0x1d7]

I wouldn't favor an application that is locked to a big player account (Microsoft, Apple, Google) where a ToS violation for something unrelated may lock you out of all services, passwords/keys included.

[moi2388]

Yes me too. And it works great. I do make a backup of it to another provider once in a while though, just in case.

[throw0101d]

Also note this from the spec:

> A Public Key Credential Source’s generating authenticator determines at creation time whether the public key credential source is allowed to be backed up. Backup eligibility is signaled in authenticator data’s flags along with the current backup state. Backup eligibility is a credential property and is permanent for a given public key credential source. A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.

* https://www.w3.org/TR/webauthn-3/#backup-eligible

[0x1d7]

Windows also has the Apple Password app.

https://support.apple.com/guide/icloud-windows/set-up-icloud...