← Back to context

Comment by tennysont

7 days ago

To be explicit, 1password did not offer passkey export for more than a year after they were introduced. 4 years later, here is 1password's page on exporting your data[1]. It says:

  You can only export passkeys in 1Password for iOS and Android at this time.

So that's not great. Let's look at their page on the 1pux export[2]:

  Your data is yours. If you want to export your data from 1Password for any reason, you can.

And the word "passkey" does not appear on that page. Why are these docs still written like this after 4 years?

And for the record, this is not impossible. Bitwarden does it[3] via the magic of "ignoring the part of the specification that says not to give users their data." Any open source software would do the same. This is why 1Password is no longer the "good guys" despite having rationalizations for their actions.

[1] https://support.1password.com/export/

[2] https://support.1password.com/1pux-format/

[3] https://bitwarden.com/help/export-your-data/

2 comments

tennysont

Reply
tennysont  7 days ago

If you want to see an example of pro-user behavior, read the github thread where a FIDO developer asked keepassxc to disallow exports of passkeys[1] or to reprompt for the db password if the website requests it[2]. The conversation was roughly:

  > keepassxc: no
  > FIDO devs: but the spec
  > keepassxc: that part of the spec is anti-user
  > FIDO devs: do it or we might blacklist your app
  > keepassxc: can't we just impersonate another password manager? also isn't bitwarden already doing this?
  > FIDO devs: "Someone else is doing bad things too" isn't the greatest argument...
  > FIDO devs: maybe we could hop on a phone call?

[1] https://github.com/keepassxreboot/keepassxc/issues/10407

[2] https://github.com/keepassxreboot/keepassxc/issues/10406