Yes you can. You can export your passkeys and then import them into whatever android password manager, or 1Password.

I was under the impression that most credential managers won't allow you to export a passkey to a plain text format, but will only allow limited app-to-app transfer of keys (with a limited selection of compatible apps only)

At least on iOS it’s any app that implements the protocol. That includes Bitwarden, which is server-based but self-hostable. In the future it should also include apps like Strongbox and KeePassium which store the private keys directly in a portable .kdbx file.

I want to import them in Android nit another app and you can export to an Android app only to another app on your iPhone

I use 1Password to sync all my passkeys between iPhone, Mac, and Windows. It works exceptionally well!

Same here. My only nitpick is that I have to carefully go through the various machines and browsers, etc, and ensure that only 1Password is ever consulted for password storage.

No browser or consumer password manager implements attestation. There's no need for users to know something that's simply not relevant for them.

Then remove it from the spec and everyone is happy. I don't trust big tech companies to not use this feature if it is available. They have too much incentive to be the sole gatekeeper for your ability to log in to services.

To remove it from the spec you would need to get enought votes in the FIDO alliance workgroups and board and whatnot. That's just politics.

Not if fear-mongering articles like this become widely circulated and make people believe attestation is widely used.

Every node package manager disables preinstall scripts by default now!

You need to explicitly update npm to 12 before this is true in Node.

And then undermine that effort by then sending you an official survey or marketing link to secure.bigbank.my.app

Santander UK sends its 'don't fall for a phishing scam' etc. emails from yoursantander2.co.uk or something stupid like that that's not what you ever interact with.

Could.

Available.

And they have been for a long time. It’s still a problem.

Never said otherwise.

But it’s technically possible.

Passkeys are unphishable. It’s technically impossible for someone else to capture your passkey and use it themselves. It’s technically impossible for your passkey to be leaked from a website.

This is what makes Passkeys the superior solution - they bake the security into itself rather than throwing up its hands and hoping all the other weakest links do the right thing consistently.

Yeah, I remember this happening before. Quick search turned up this from two years ago for Sequoia https://www.reddit.com/r/MacOS/comments/1fl035s/macos_sequoi...

I presume Anthropic didn’t have any privileged access to any of these websites and services. What differentiates them from any other spam bots or people out there submitting junk to random POST endpoints?

Don’t get me wrong - think Anthropic is acting with not enough scrutiny or punishment here, but the world is already extremely lenient towards this behaviour. Why hold them to a higher standard?

I'm not aware of a single person in the world that likes spam bots or thinks that they are a good thing.

Why are you surprised that a company doesn’t want to make the robot that tells people to kill itself, or drink bleach?

They aren't. They are saying that putting this safeguard at the level of the agent execution is a waste of time, particularly that of the researchers' expensive manhourse, especially now that existing smaller models can just evaluate the output.

It's fine if they seek to avoid that. But those are perfect examples of things a cheap output-filtering model can be responsible for enforcing, without wasting the time of the researchers who are working on the training and alignment of the model in the ways that actually matter.

Most "bad outputs" in areas like 'self harm' or 'violence' or 'sexual' whatever are a result of people deliberately trying to elicit those responses. As such, it's meaningless whether an LLM writes the Bad Thing or if the user writes it himself.