Comment by sandmn
5 days ago
Except that in almost all implementations passkeys can't be extracted or copied, unlike ssh keys. Great for enterprise, terrible for home use.
5 days ago
Except that in almost all implementations passkeys can't be extracted or copied, unlike ssh keys. Great for enterprise, terrible for home use.
In best practices for SSH keys you should be using different keys on every device and shouldn't be extracting/copying them. Best practices are also to use different keys for every SSH host in addition to per-device keys.
Passkeys enforcing keys not be extracted/copyed as plaintext and that keys are per-host/domain are just following ancient SSH best practices.
Because yes the SSH world is sloppy with dangerous plaintext (or modest password encrypted) key copying and reuse. That does make it a "simpler" ecosystem, but that doesn't make it a better ecosystem.
That said, Passkeys generally are frequently copied, most of the ecosystems support multi-device sync and backup. They just aren't done in a way that provide plaintext export if you want to print a book of your Passkeys and store it in a safe deposit box or sloppily `scp` them from one machine to another.
I think KeypassXC already provides plain text export and Bitwarden provides some export as well. I guess eventually either passkey ecosystem will become locked to a few specific vendors that won't implement functionality FIDO does not like or passkeys will be extractable. In first case it'll become vendor locked corporate standard, in second - same as passwords with url verification.
Or it can stay a niche standard most people don't care much about, we'll see.
I think it's only technical users and paranoid users that care about export. Non-technical users are fine with device auto-sync and Cloud backup/restore, which is what they get today out of the box from the most common Password Managers.
We are in the era where the average non-technical user doesn't even necessarily know what a file even is, they are used to apps managing everything with Cloud sync and "just working".
Export can be handy for "offline" backup, but in practice the thing to backup offline is the device PIN or Password Manager "master password". Especially because in practice you aren't using just one Passkey, you are using hundreds or thousands. (One per host/domain/app, at least.)
> implement functionality FIDO does not like
The KeypassXC GitHub issue wasn't "FIDO", it was one guy acting like he could make threats on behalf of FIDO, without even the full backing of his employer, much less other members of FIDO. It was bad communication to write a suggestion in the form of a threat and pretending to speak for others.