Comment by LeoPanthera
3 years ago
1Password enabled PassKey support recently and I was "surprised" to learn that there is no way of exporting them out of 1Password. They're not included in the 1PUX format export, nor in the CSV.
That means that they're literally impossible to back up. If 1Password goes down, or the company stops operating, or anything else like that, your Passkeys are just... gone. Absolutely no way to recover them.
Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys.
See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd...
Re. your point about 1Password going down: Your passwords and passkeys are all stored locally when they sync to your devices. If 1Password becomes unreachable for any reason, you still have access to everything in your vaults, you just can't sync between devices any more.
It's difficult not to see the "it's for your own security" argument as a cynical lock-in ploy.
Because you can export plain-text passwords just fine, and they give you exactly the same access as a PassKey does.
> nobody wants to allow plaintext export of passkeys.
While noble, why? 1Password exports a plaintext file that has all of the credentials in plaintext already.
I guess "100% secure against phising" is incompatible with "the user can in any way access the key" because if you knew the key, in theory some super-convincing phishing site could get you to spill it.
I still think the real reason is lock-in, but I could imagine this is their official justification.
Given all of the horror stories (some real, some hypothetical) told in this thread, it seems that one of the major side effects of passkeys — if not the primary purpose — is to keep you locked into whatever you used to create your passkey. Plaintext export would ameliorate that.
Because passkeys are supposed to be a bit more secure than plaintext passwords.
3 replies →
Because in this brave new world you aren't supposed to own your keys, some proprietary HSM inside your device does.
And what a surprise that is, the one feature necessary to ensure vendor lock in doesn't happen was at 0 priority before they rolled it out.
The whole point is vendor lock-in.
4 replies →
If you consider KeePassXC to be one of the big players, they (will) support importing and exporting Passkeys.
...and if i understand correctly, websites can dictate whether they allow KeePassXC (or any other specific vendor) to store their passkey.
In other words, if a website doesn't like that their passkeys can be exported, they can block KeePassXC.
> "If 1Password becomes unreachable for any reason, you still have access to everything in your vaults"
Temporarily, i guess? Since it's not stored in an open format?
Is this not bound to some sort of "Secure Enclave" or whatever, and won't survive a reinstall / restore / etc. ?
Isn't that the point of Passkeys? The user isn't allowed to interface with them directly, so social engineering can't compromise them [1]. Rather than move your passkey between devices, you're meant to generate a different passkey for each device, then register all of them with the relevant service, like SSH keys.
1: of course, a user could still be tricked into adding an attacker's passkey to their account or something
But 1Password syncs your passkey to all your devices, so you only have one.
Don't worry, if you lose your passkey all you need is access to your email to receive a password reset link. </sarcasm>
4 replies →
I had a discussion with my mother advising her to switch: she is afraid of changing ISP because her email is tied to her provider.
We fixed this on mobile years ago but email is still a goddamn mess. Moral of the story: never get locked in.
You're not locked in. Want to switch? Add a passkey. Lose all your passkeys? Do the "forgot password" thing just like you've done forever.
The "forgot password" flow involves accessing your email. And accessing your email without having access to your passkey requires a device that has previously logged in to your email. And the device that has previously logged in to your email is the same device where your passkeys are stored, which is to say, the same device that is now lost or bricked, which is the reason your passkeys are lost in the first place.
And sure, you and I have multiple devices. We're in the minority. Most people just have the one. Without another way in, they're irrevocably fucked.
1 reply →
Do any of the third-party, self-hosted password managers provide a compatible passkey implementation that can actually be exported and backed up in a secure manner?
1Password's Passkey support feels very aggressively growth-hacky to me. They intercept calls to `window.credentials` and if you want to use 1Password along side other verifiers like Yubikey, you need to go into your settings and disable their passkeys offering entirely. It's similar to how they also intercept (and globally disable!) Google One Tap prompts in order to show their own OAuth prompt. I only use their Chrome extension so I'm not sure if the native app experience is significantly different.
I'm kind of mad at 1Password - but this isn't correct. When the 1Password prompt some up, you can click the little "USB key" icon which ostensibly is for hardware keys, but all it does is pass control back to the OS, at which point your iCloud prompt, or whatever provider you are using, can be used.
Ah, good to know. I immediately turned off the monkeypatching and didn't spend too much time playing around with it.
Is version 8 reasonably mac-like? On 7 it's still a mac application that acts like a true mac application (drag/drop works properly everywhere, expansion, properly keyboard-enabled, etc) which is well nigh impossible when running inside a chrome box.
Agile Bits support kept insisting it was the same as the old native app and people kept complaining about bugs until I stopped following it.
It's as Mac-like as any other Electron app. Which is to say, it does a pretty good impression of a Mac app, but the bundle is 345M, with another 244M hiding in your Library directory.
It’s so rare that I use anything other than the 1Password Chrome extension that I couldn’t really tell you! The main app seems.. fine? But like I say, I hardly use it, so I probably wouldn’t notice details like you mention.
Do you have a different workflow where you use the main app a lot?
I keep a lot (including images) in the main app as an ecrypted shared resource for IDs and various other secure info. If I suddenly need my insurance card I can quickly grab it out of the app rather than rummage through the (unencrypted) icloud or dropbox filesystem on ios. And I can cut/past text out of the images. I also use it for logging into apps, dragging credentials into remote machines over ssh etc.
With 1password 7 whe safari plug in is more conveniently integrated than the chrome one which is pretty clunkly by comparison, though this is true of other chrome plug ins too. But that's not a big deal as I rarely use chrome anyway, just for google docs which don't need 1password.
1 reply →
This is a quibble, but if 1password goes down, your vaults still exist on all your devices and the app will keep working, it's only the syncing of modifications between devices that won't work.
It's a feature that came out just last month. Give them some time.
Can't you enroll a Yubikey and keep it in a safe?