Comment by Telaneo
8 days ago
> Sigh. IT LITERALLY IS.
> The name "passkeys" itself means "exportable keys":
> https://fidoalliance.org/passkeys/
This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked. Nor did I see anything indicating that was a core part of their design from a cursory reading of the page, although I might have missed something. Your quote certainly doesn't imply 'exportable'.
Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended. To quote Tim Cappalli, who's credited on the W3C spec as an editor[1] and maintains passkeys.dev,[2] so presumably knows what he's talking about: "Passkeys should never be allowed to be exported in clear text."[3]
[1] https://www.w3.org/TR/webauthn/
[2] https://passkeys.dev/about/
[3] https://github.com/keepassxreboot/keepassxc/issues/10407
> This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked.
I literally provided a citation.
> Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended.
A syncable credential is by necessity representable in clear text at some point. In comparison, resident WebAuthn private keys NEVER leave the secure device.
> [1] https://www.w3.org/TR/webauthn/
WebAuthn is a _superset_ of Passkeys. Here's the citation from your own linked page:
> This use case illustrates how a consumer-centric Relying Party can leverage the authenticator built-in to a user’s devices to provide phishing-resistant sign in using multi-device credentials (commonly referred to as synced passkeys). ... > A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.
> I literally provided a citation.
That I said does not support your statement.
> A syncable credential is by necessity representable in clear text at some point.
I never said this was wrong.
> WebAuthn is a _superset_ of Passkeys
I don't see how your quote illustrates this, and I've only heard them referred to as the same thing. Would you care to elaborate? And maybe provide an example?
I literally quoted it in the message above:
> multi-device credentials (commonly referred to as synced passkeys).
> A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential.
The previous name for single-device credentials was "resident keys".
So yes, providing a way to export and back up the Passkeys was _literally_ the intention of the WebAuthn authors from the beginning. The ability to export and sync passkeys was not a temporary accident, it has always been intended functionality.
1 reply →