Looks like a huge amount of security vendors are working to have a secure and open standard for passkey portability between platforms.
It is always good to see major collaboration in the security space like this considering the harsh opinions that users of some of these vendors have toward many of the others. I just wish apps and sites would stop making me login with username and password if passkeys are meant to replace that lol.
Seems like people in the comments are misunderstaning the announcement entirely. This protocol is about import and export from password managers and not about having them synced between devices. It would prevent a lock in effect. This is a great development!
FIDO Alliance’s draft specifications – Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) – define a standard format for transferring credentials in a credential manager including passwords, passkeys and more to another provider in a manner that ensures transfer are not made in the clear and are secure by default.
Lock in effect of passkeys is just infuriating 😂good to see progress!
I personally like it. Imo passkeys should optimally be device bound and the private keys should be stored in TPM or equivalent and be non-exportable.
Well, nothing is stopping you to keep passkeys only in one place, why force others to do what you like? Now we have options and less friction to switch to a competitor. Which results in more competition and that results in better products. Well theoretically…
I don’t like that passkeys are portable, this kind of defeats the entire purpose. The way they were sold to me is the following: it’s 2 factors in one. The first is the actual device where the key lives, and the second, the user verification, like a pin, face scan, fingerprint etc. If it’s synced across the cloud, there’s no longer the first factor being the unique key on the unique device.
Granted, passkeys even without the first factor are still magnitudes better in terms of convenience and security compared to passwords, but it just disappoints me a little that there are no good options to save passkeys on my local device only, with no cloud sync.
If anyone knows of a local-only passkey manager app for android, as well as the same as a firefox extension, I’d love to know about it!
I guess you’re better off buying a physical security key, which offers some guarantee that the keys cannot be exflitrated from the device.
I have one, but I use it as a second factor because it does not have a way of identifying me
Yubikey supports pin protection, the newest one even have a fingerprint scanner.
Strange, my Yubikey allows me to authenticate using Passkeys just fine by entering the PIN that protects my stored credentials.
If you don’t want to sync your credentials with a server, why are you using a server based credential manager?
For 2 reasons:
- I want to sync my credentials that cannot be made unique and revocable (ie passwords). I can have a single passkey per device, I cannot have a password per device for a same account. I also have to memorize a password, and I have hundreds that I may need to access while I am away and only have my phone.
- I use one because currently I have not found a convenient way to save local passkeys on Android and my Linux PC.
You can save local passkeys using a local keepass file and keepassXC. No cloud needed.
