Comment by secabeen
7 days ago
Bitwarden is the only vendor I'm aware of that currently allows this, and it wouldn't surprise me if their new management takes this away in the medium term.
The FIDO alliance is trying very hard to squash any workflows that a scammer can use to convince an elderly retiree with $1mil in savings to wire their life savings to Russia. Unfortunately, nearly all of the export paths that we want as hackers overlap with these attack vectors. The drafts of the Credential Exchange format or Protocol assume that end-users and open-source tools are not valid targets.
Skimming through the exchange protocol draft it seems like a pretty standard diffie-hellman. Seems easy enough to write a FOSS script that requests an export and then dumps it to plaintext.
My read of it is that there won't be an endpoint for an FOSS script to connect to to make the request. All that stuff will be provider2provider on private channels that aren't publicly exposed.