Comment by rufo

8 days ago

For passkey export, there is a FIDO specification for both a format and secure protocol for exchanging passwords and passkey information between password managers, with support on all Apple platforms, and implemented by 1Password, Bitwarden, Dashlane, and more:

https://rmondello.com/2026/09/07/switching-password-managers...

https://fidoalliance.org/download-credential-exchange-specif...

For the iCloud syncing, I believe they've done that since iCloud Keychain/Apple Passwords was first a thing; I've been aware of it since they introduced it, but perhaps that was more explicit when it was first added. The comment below from a now-defunct 1Password employee account describes the thinking there:

> Importantly, the entire role of the Secret Key is to protect you from us and anything that might happen on our end, like a breach of 1Password’s servers. It does not (and can not) protect you from a local attack. This is mentioned in 1Password’s Security Design white paper [ed: on page 74 of an old PDF; I've linked the newer HTML document below], which goes into detail about the locally exposed Secret Key.

https://www.reddit.com/r/1Password/comments/10iqhdp/comment/...

https://agilebits.github.io/security-design/index.html

I do get why that might be surprising. Without going through the whole onboarding process on a fresh device I can't say how well they highlight that or how easy it is to blow past. All I can say is 1) I've known about it for years and 2) having read through the white paper of how iCloud Keychain works I _personally_ trust iCloud Keychain/Passwords about as much as I trust 1Password, maybe _slightly_ more - but I am also not a security professional, so take my word with very little salt :)

6 comments

rufo

tennysont 7 days ago

To be explicit, 1password did not offer passkey export for more than a year after they were introduced. 4 years later, here is 1password's page on exporting your data[1]. It says:

  You can only export passkeys in 1Password for iOS and Android at this time.

So that's not great. Let's look at their page on the 1pux export[2]:

  Your data is yours. If you want to export your data from 1Password for any reason, you can.

And the word "passkey" does not appear on that page. Why are these docs still written like this after 4 years?

And for the record, this is not impossible. Bitwarden does it[3] via the magic of "ignoring the part of the specification that says not to give users their data." Any open source software would do the same. This is why 1Password is no longer the "good guys" despite having rationalizations for their actions.

[1] https://support.1password.com/export/

[2] https://support.1password.com/1pux-format/

[3] https://bitwarden.com/help/export-your-data/

tennysont 7 days ago

If you want to see an example of pro-user behavior, read the github thread where a FIDO developer asked keepassxc to disallow exports of passkeys[1] or to reprompt for the db password if the website requests it[2]. The conversation was roughly:

  > keepassxc: no
  > FIDO devs: but the spec
  > keepassxc: that part of the spec is anti-user
  > FIDO devs: do it or we might blacklist your app
  > keepassxc: can't we just impersonate another password manager? also isn't bitwarden already doing this?
  > FIDO devs: "Someone else is doing bad things too" isn't the greatest argument...
  > FIDO devs: maybe we could hop on a phone call?

[1] https://github.com/keepassxreboot/keepassxc/issues/10407

[2] https://github.com/keepassxreboot/keepassxc/issues/10406

deltoidmaximus 7 days ago

This is where the attestation feature comes in, there's a reason it was part of the initial spec and key transfer was a "we'll get to it later". They will use it as a weapon to blacklist providers that don't play by their rules.
https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
https://github.com/keepassxreboot/keepassxc/issues/10406

someguyornotidk 7 days ago

> For passkey export, there is a FIDO specification for both a format and secure protocol for exchanging passwords and passkey information between password managers, with support on all Apple platforms, and implemented by 1Password, Bitwarden, Dashlane, and more.

Does (more) here include free software like keepassxc and friends which don't restrict what key owners do with their keys? Last I heard, FIDO was moving to ban them.

tennysont 7 days ago

Regarding just the iCloud syncing, I appreciate the additional color.

Though, I do find it amusing that I commented about 1password's inability to communicate their security model, and your reply links a reddit post[1] in which everyone is disagreeing over whether or not iCloud secret key syncing actually occurs.

[1] https://www.reddit.com/r/1Password/comments/10iqhdp/comment/...

secabeen 7 days ago

Note who is excluded from this list: the End User. The protocol only allows exchange between password manager vendors who choose to interconnect.