Comment by abraxas
5 days ago
What I'd like to understand is why the majority of sites that allegedly supoprt passkeys do not let me store them on Yubikey hardware but instead are pushing into "cloud" passkeys. That's what is triggering my spidey sense about the whole scheme. If they are so great all around and vendor neutral why is everyone pushing me to store my keys in some "cloud" password manager? If I'm going to the trouble of setting up passkeys I want to be in control of them across all my accounts. That means my own hardware dongle. Not some cloud vendor's pinky swear that they'll take care of them and let me use them on my terms.
Websites can't choose for cloud passkeys. That's your OS or your browser.
They can request you store the passkey in something non-exportable, but many software passkey providers simply lie about being super duper secure.
My OS (Arch), my browser (Firefox) and my hardware (Yubikey) all work fine with some sites. For example my Google account credentials are on my Yubikey passkey. But half of the sites that claim to support passkeys won't offer me the option to save the passkey on my hardware. Paypal is one such example. Facebook is another. I don't understand why. They seemingly only want to cooperate with cloud based passkey storage. I don't know what mechanics govern this.
Paypal refuses to offer generating a passkey on either Firefox or Chrome on Linux. Spoofing the UA to Firefox on Windows does work, though. Whatever they're doing, it's not normal. I'm surprise you run into it so often.
This is the first time I've seen this issue, very weird. Then again, I had to apply some kind of hack to enable TOTP back in the day (something about faking an RSA key fob), so I'm not surprised Paypal is stil shit.
Paypal's implementation is weird. They have it locked behind some other kind of check so it only seems to prompt to make a passkey sometimes and then it only ever asks for that passkey on that device.
(the UX flows around passkeys are horrendously inconsistent between implementations in general, but even still paypal is a bit of an outlier.)