What that Keepass X GitHub PR comment section was discussing was giving users a way to export their passkeys to an unencrypted file on disk, which would have allowed for attackers to convince non-technical users to export all their passkeys and then send them to an attacker.
I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time.
> no one supported exporting passkeys at the time and I believe the only ones who supported passkey sharing of any kind was Apple
What exactly is the practical difference between "sharing" a key and "exporting" it?
As it is, Apple's Passwords app as of today absolutely allows importing and exporting of Passkeys ("Transfer to another app").
> I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time.
This is a very diplomatic presentation.
This was in Tim's very first reply:
> To be very honest here, you risk having KeePassXC blocked by relying parties (similar to #10406).
> I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).
> Asking you to put basic protections in place and collaborate with the ecosystem/industry is hardly "anti-user-choice mentality".
"Sure would be a shame if the industry had to block your tool from our standard."
> which would have allowed for attackers to convince non-technical users to export all their passkeys and then send them to an attacker.
I mean, if you can convince a user to do that, there's not much more needed to say "and you can set a password on the encrypted export so it's all secure!" and get an encrypted export too.
> Fast forward to today... and it looks like there's movement towards doing exactly that:
Oh, it only took 2 1/2 years. Most of which was waiting on the FIDO Alliance to actually define a standard:
> > I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here.
> There are hundreds of encryption options to choose from. Sure, we can choose AES-256-GCM. To what end? If no other product implements that encryption option, then exporting becomes worthless for portability.
> Define the standard first (just pick one or two), then publish it. There is no need to spend time debating the choice, plenty of great options to choose from.
Indeed, at the time:
> This is out of scope for the protocol and data format. Neither -and to use the working names here- CREEP (CREdential Exchange Protocol) nor CEF (Credential Exchange Format) should make any determinations about how the importer, exporter, or platform should store their keys, but we'll say that it should be secure.
But Tim didn't mention any such thing. As to this claim:
> it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time
"was almost finished"?
CXP is still in "Working Draft" status as of today, where it has been for 2 years.
CXF (the format) is a "proposed standard" as of today.
My point is did everyone know all of those principals and how committed Anthropic was to them from the beginning or did new information come in and now they need to adjust. Just because something is a term in a contract that doesn't mean it's necessarily strongly held belief that will never change.
People treating their political party as a “team” is one of the biggest problems we have right now as a society, so I find this language of “red team” and “blue team” extremely concerning.
Majority of second factors are phishable. If you are using a password (phishable) + a phishable second factor (any kind of 6 digit code that you need to type or paste into a text box), you are less secure than if you were using only a passkey.
>They want you dependent on them and locked into their ecosystem.
This is a strange conclusion to come to when clearly a lot of effort was put into developing an open standard (Credential Exchange Format) to make it easy and secure to move credentials between vendors/ecosystems, without opening end-users up to phishing attacks on credential export.
If big tech wanted to lock people in, it seems like it would have been a lot easier to just... not create an open standard.
>I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well.
This was never a design goal of passkeys as far as I'm aware, and normally passkeys are not generated or stored in a TPM. The primary design goal of passkeys was to make a phishing-resistant primary factor that could compete with the user experience and convenience of passwords, so that folks would actually be interested in using them.
I think you are thinking of security keys, which generate key material in e.g. a YubiKey which offer similar protections to a TPM.
YubiKeys can also be used to generate/store passkeys, but when they are used for passkeys typically they'd be referred to as "device-bound passkeys" rather than just "passkeys".
> I don’t see hardware tokens (like Yubikey) in the list. Those are the only ones that provide a true second factor
passkeys are not meant to be a second factor; they are meant to replace the password as a primary factor.
>to protect against the theft or compromise of your primary device.
I love Yubikeys, but the only additional protection you get by making the passkey hardware-bound is preventing an attacker who has already compromised your operating system from stealing the credential.
But! Unless you are also doing hardware binding of the session (aka cookie) after sign-in, then doing hardware binding of your credential is mostly security theater, because the attacker can just wait for you to sign in and then steal your session.
I have no idea if Yubico is involved with DBSC, but I would hope that they are, because it would help them make Yubikeys live up to the security guarantees that I personally feel are heavily implied by their marketing.
There are some parts of this that are correct and other parts that are incorrect:
>1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).
This is incorrect. The idea was to provide a phishing resistant primary factor that could compete with the usability of passwords to the point that consumers would actually want to adopt it.
>2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers
This is correct/accurate.
> 3. The vision for collaboration never materialized so everyone went their own way to implement it. Examples would be google rolling out browser (Chrome) managed authentication which led to this situation where even on the same machine you have to remember which browser you used to create the Passkey credential.
IIRC at least Chrome's default on Apple platforms is to save to the Passwords app by default. There are then multiple fallback options in the case that the user isn't using the default credential provider -- ultimately falling back all the way to cross-device passkey sign-in (the QR-code initiated sign in) or Security Key.
That said, I strongly agree that fragmentation of where passkeys get saved is super confusing and I wish there:
(a) was stronger guidance from the FIDO alliance on both educating users that it's totally fine to have multiple passkeys across different ecosystems (e.g. one in Apple, one in Google), and;
(b) that all the credential managers could figure out a better way to place nice together and make it super clear to the end-user where a passkey is getting stored, what context it's for (e.g. personal vs. work), and actively help them store it in the right place (which might be different credential manager app for personal vs. work!).
> 4. Interestingly enough the earlier popular name was WebAuthn, Apple started calling it Passkey on fly, given Apple's popularity everyone just caved in.
This is incorrect -- passkeys are not just another name for WebAuthn. If you go back and look at the original definition Apple gave for the word passkey, you'll find that it was meant to be a discoverable WebAuthn credential that syncs across a user's devices with end-to-end encryption. There was a bunch of industry thrash around the definition, but it seems like the original Apple definition has largely stuck/settled now, and when passkeys don't sync they're typically called "device-bound passkeys" rather than just "passkeys".
>5. My personal interpretation is that in some sense Apple wanted to be the default password manager on Apple devices.
If you go back and watch the original passkeys announcement from Apple, their stated goal was to create something that is both a better user experience and more secure than passwords. By "better user experience", they meant the act of creating credentials and then repeatedly using those credentials (logging in).
Part of actually achieving that goal means there needs to be something that "just works automatically out of the box" which means there needs to be a built-in credential manager. That said, Apple credential manager had already existed for many many years by the time passkeys came around. The only thing that changed was instead of being solely accessible from inside System Settings (which was hard for the average user to find), the functionality moved into a standalone Passwords app.
>6. This is when all password manager companies jumped in strongly to save their business and the protocol went into a direction where you can use your existing password manager to store the credential/Passkey as well
I think it's a huge positive that all the password managers jumped on board, and that they could jump on board (since WebAuthn is an open standard). I think this is a good thing for consumer choice and for overall adoption and perception of passkeys. A lot of folks (including on this thread) have big tech lock-in conspiracy theories about passkeys, and the conspiracy theories would be even more prevalent without a wide spectrum of consumer choice for credential managers.
>If you are using it with security in mind then my recommendation would be to use a hardware backed security key with NFC enabled. Everything else is pretty much lipstick on pig, they are worse than passwords in some sense from usage perspective.
Passkeys protect against phishing attacks, and you get that protection regardless of whether the credential is hardware-bound or not. That protection comes from the cryptographic binding of the credential to the domain at the time of credential creation.
The only additional protection you get by making the passkey hardware-bound is preventing an attacker who has already compromised your operating system from stealing the credential. But! Unless you are also doing hardware binding of the session (aka cookie) after sign-in, then doing hardware binding of your credential is mostly security theater, because the attacker can just wait for you to sign in and then steal your session.
I try to be accurate when sharing information like this. Some things are fact and some things are opinions, I already tried to annotate the opinions as interpretation. Most of the information is first hand, I was a member of FIDO alliance in past, have been watching these discussions.
1. This can be subjective, Unfortunately Customer identity is not on the highest priority from security perspective, its all about ease of product use when it comes to customer identity. For customer identity, most account recovery methods still fall back to email or SMS even if you have 2FA configured. The real money lost with phishing is with enterprise identity, when some one poses as an employee. The recovery of these accounts can be managed. If a customer account gets hacked then the business is not really on the hook to make it even.
> Usability of passwords
This is the biggest point of contention as per my interpretation. The industry did a very poor job of securing their infrastructure leading the massive leaks of password databases. Instead of fixing that goal post changed, with the by introduction of PASSWORDLESS. The passwordless works just fine for enterprise identities, not the customer identity. Even for enterprises, you cannot get rid of passwords if you get into AAL concepts (guidelines provided by NIST for authenticator assurance levels)
4. I was working on WebAuthn when the term passkey was not there, I was there when the term was introduced, I saw how every one was trying to map their existing definition/understnading with the new terminology specially the part where Apple just announced them to be syncable. Enterprise companies had to actually disable the Apple Passkeys for this reason to begin with. I found it interesting to see how Yubico changed their documentation overnight, they switched every instance of WebAuthn keyword with Passkey. It took some time to settle on how to categorize discoverable credentials (where meta information about user is on the device in addition to credential) and non-discoverable credentials (hardware keys, they are limited in space so they did not store user meta information in earlier versions). Eventually google took the lead in calling the credential where private key cannot be synched as Security key and everything else as Passkey. Resident key, syncable, synched are all different bits of the WebAuthn assertion
5. Thats an interpretation of how I read things based on the overall play going on.
> Passkeys protect against phishing attacks, and you get that protection regardless of whether the credential is hardware-bound or not. That protection comes from the cryptographic binding of the credential to the domain at the time of credential creation.
The security aspect is tightly coupled with the authenticator implementation. The phishing aspect is the only default good in here, it just means that the credential is strictly tied to a particular domain, the one on which it was set, that too is highly dependent on the client (browser) doing the right thing. Additionally you have to count on the server to not get compromised as well (There is a a feature to support multiple domains).
Most importantly, when you make something this hard and complex to understand then be advised that people are going to make mistakes in implementation and leave gaps in security.
This is the #1 most common misconception I see about passkeys. They do not make it more likely that you will lose access to your accounts. They actually have nothing to do with account recovery. They are just a stronger primary factor than a password.
Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.
And email based account recovery does not make the security advantages of passkeys disappear, which are:
- credential that's guaranteed to be unique
- credential that's guaranteed to be strong
- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)
- changes the incentives for compromising servers (there's nothing worth stealing from the server -- only public keys)
- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks
And if the account recovery scenario in question is your Gmail or Apple account, then you would need to go through their account recovery flows regardless of whether you were using a password or a passkey:
>Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.
Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.
And email based account recovery does not make the security advantages of passkeys disappear, which are:
- credential that's guaranteed to be unique
- credential that's guaranteed to be strong
- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)
- changes the incentives for compromising servers (they're nothing worth stealing from the server -- only public keys)
- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks
This is factually incorrect — no one supported exporting passkeys at the time and I believe the only ones who supported passkey sharing of any kind was Apple: https://support.apple.com/guide/iphone/share-passwords-iphe6...
What that Keepass X GitHub PR comment section was discussing was giving users a way to export their passkeys to an unencrypted file on disk, which would have allowed for attackers to convince non-technical users to export all their passkeys and then send them to an attacker.
I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time.
https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20240522.html
Fast forward to today... and it looks like there's movement towards doing exactly that:
https://github.com/keepassxreboot/keepassxc/pull/13343
--
Edit: Indeed if you scroll down to the last comment on that infamous PR (https://github.com/keepassxreboot/keepassxc/issues/10407#iss...), you'll see they closed it in favor of implementing the Credentials Exchange standard.