← Back to context

Comment by cyberax

8 days ago

> This does not follow from my understanding of the word, and the words 'export' and 'exportable' don't appear on the page you've linked.

I literally provided a citation.

> Syncable? Yes. Exportable? Yes. Clear text? Sure, behind the scenes. Exportable as clear text? Yes, but not intended.

A syncable credential is by necessity representable in clear text at some point. In comparison, resident WebAuthn private keys NEVER leave the secure device.

> [1] https://www.w3.org/TR/webauthn/

WebAuthn is a _superset_ of Passkeys. Here's the citation from your own linked page:

> This use case illustrates how a consumer-centric Relying Party can leverage the authenticator built-in to a user’s devices to provide phishing-resistant sign in using multi-device credentials (commonly referred to as synced passkeys). ... > A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.

3 comments

cyberax

Reply
Telaneo  8 days ago

> I literally provided a citation.

That I said does not support your statement.

> A syncable credential is by necessity representable in clear text at some point.

I never said this was wrong.

> WebAuthn is a _superset_ of Passkeys

I don't see how your quote illustrates this, and I've only heard them referred to as the same thing. Would you care to elaborate? And maybe provide an example?

  • cyberax  8 days ago

    I literally quoted it in the message above:

    > multi-device credentials (commonly referred to as synced passkeys).

    > A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential.

    The previous name for single-device credentials was "resident keys".

    So yes, providing a way to export and back up the Passkeys was _literally_ the intention of the WebAuthn authors from the beginning. The ability to export and sync passkeys was not a temporary accident, it has always been intended functionality.