Password manager can store passkeys as well. They’re way easier to fill than passwords, they always work and never have issues with filling like you can have on some websites that just don’t work well with pw managers.
Still needs an arguably perhaps overengineered complicated standard to do it, and seems to open the door to more hardware attestation demands. I’m not a fan and I refuse to use passkeys. (But I can see the use for preventing fishing attacks, so I realize there is no obvious perfect answer here.)
And… honestly, you should probably buy 3. Losing your main key only to find out that your backup key broke a month ago and you haven’t been testing it is a real risk.
They’re actually not tied to a device. They can be synced across devices.
Bitwarden, 1Password, Dashlane, Google, Apple, and Microsoft will all do passkey syncing for you.
We don’t yet have a good Linux native passkey store. I believe the credentialsd project is working on a spec for that. Once that’s up and running I would expect to see some options for syncing without relying on a third party service (though, you can self-host bitwarden right now). It’s definitely not seamless on Linux yet though.
Sadly 4 of those companies are American, and Dashlane has significant US operation presence, making those recommendations unacceptable to me - ymmv
1password is Canadian and zero-knowledge so could be an option if i didnt already use a different service.
I dont like the idea of pre-authorising a device to handle credentials and access in perpetuity at the hardware level. I’d be fine with having a hardware key that holds passkeys but cant use them, while the device using them can only do so when i put the two items together.
Unfortunately i do not understand how to save a passkey to a hardware key or how to manage them once that is done. Till someone gives me a straightforward ux to do that, i’ll be using unique passwords, a manager, and totp.
If i am misunderstanding, thats just a different problem; the passkey thing needs to be explained more clearly.
Microsoft makes a hard distinction between Device-Bound and Synced passkeys inside of corporate tenants. They are in fact two different things that happen to be using the same FIDO standard, and can be stored alongside one another in the same app if it supports it.
Also KeePassXC with the browser plugins works a treat for synced passkeys.
I have a password manager and hardware token. I see no need to use passkeys.
Password manager can store passkeys as well. They’re way easier to fill than passwords, they always work and never have issues with filling like you can have on some websites that just don’t work well with pw managers.
Still needs an arguably perhaps overengineered complicated standard to do it, and seems to open the door to more hardware attestation demands. I’m not a fan and I refuse to use passkeys. (But I can see the use for preventing fishing attacks, so I realize there is no obvious perfect answer here.)
Yubikey4lyfe
Yubikeys support device bound passkeys already.
But you need to buy at least two of them, which isn’t cheap.
And… honestly, you should probably buy 3. Losing your main key only to find out that your backup key broke a month ago and you haven’t been testing it is a real risk.
Not every service allow for registering more than one passkey
And what are they odds of simultaneous losing / breakdown of all three keys? I think they are not negligible.
I ended up getting one through arstechnica (they sent one if you subscribed back then), then I got more through some sale or something
are passkeys not a type of a hardware token? they’re tied to a device.
They’re actually not tied to a device. They can be synced across devices.
Bitwarden, 1Password, Dashlane, Google, Apple, and Microsoft will all do passkey syncing for you.
We don’t yet have a good Linux native passkey store. I believe the
credentialsdproject is working on a spec for that. Once that’s up and running I would expect to see some options for syncing without relying on a third party service (though, you can self-host bitwarden right now). It’s definitely not seamless on Linux yet though.Sadly 4 of those companies are American, and Dashlane has significant US operation presence, making those recommendations unacceptable to me - ymmv
1password is Canadian and zero-knowledge so could be an option if i didnt already use a different service.
I dont like the idea of pre-authorising a device to handle credentials and access in perpetuity at the hardware level. I’d be fine with having a hardware key that holds passkeys but cant use them, while the device using them can only do so when i put the two items together. Unfortunately i do not understand how to save a passkey to a hardware key or how to manage them once that is done. Till someone gives me a straightforward ux to do that, i’ll be using unique passwords, a manager, and totp.
If i am misunderstanding, thats just a different problem; the passkey thing needs to be explained more clearly.
Microsoft makes a hard distinction between Device-Bound and Synced passkeys inside of corporate tenants. They are in fact two different things that happen to be using the same FIDO standard, and can be stored alongside one another in the same app if it supports it.
Also KeePassXC with the browser plugins works a treat for synced passkeys.