Comment by timmyc123
5 days ago
Lot's of additional great information for consumers and prosumers at whatarepasskeys.info. Many of the questions that are constantly discussed in these comments are answered in the FAQ and content.
Contributions and feedback are welcome! GitHub link is at the bottom of the page.
Why are passkeys designed in a way that I can't copy the private key as text to import into whatever password manager I want, even as an advanced user?
You can. Choose a credential manager that offers that feature.
I just don't think that's a good idea for most users. Imagine an older relative being coaxed into exporting all their passkeys in plaintext and uploading them to a website.
There's seemingly no password manager that lets me export the passkey as plaintext, at least not on a Mac. At best I can hand off to another app, which only works from Keychain and nothing else, and can only go to a preset approved list of apps like 1password. iPhone situation is a bit better, at least I can transfer from 1password to other things, but again it seems like a whitelist and there's no way to just get a csv.
Besides all that, the standard supposedly supports types of passkeys 1. bound to the device (not a security key) that cannot be handed off at all, or 2. can only be used in certain apps. I'm guessing the first case is more for corps that only want employees logging in with issued corp devices, but why the second one?
Everything has conditions, which is why I'm wondering why this isn't just an unconditional "yes, it's your key, do whatever you want."