Looks like a huge amount of security vendors are working to have a secure and open standard for passkey portability between platforms.
It is always good to see major collaboration in the security space like this considering the harsh opinions that users of some of these vendors have toward many of the others. I just wish apps and sites would stop making me login with username and password if passkeys are meant to replace that lol.
If they’re not portable how would I for example login to an account while on my Desktop, if I set up the passkey on my Phone?
You generate a second one on the other device.
Assuming that all services you log into support multiple passkeys. My auto financing company doesn’t, for example
Well, then it seems like they have not understand the idea behind passkeys, like so many…
I’d like to see some documentation that says passkeys were intended to never be synced across anything.
Everything I have ever read is that it’s basically asymmetric cryptography like ssh keys. You have a private one, generate the public and give it to the site. It stops reuse of passwords and site breaches become useless as the public key is useless for attacking an account on another site, etc. (well, besides whatever data was lost in the breach which is outside the scope.)
I see no reason to limit someone having the private key on their phone, their desktop, etc. Having to generate yet another passkey for every device is inefficient and would decrease adoption of this.
Yea, ssh private keys as well are intended to only stay on Device that generated it. The idea is, that the device you want to connect to has all the puplic keys of all devices you want connect from in their known hosts directory. And you should not transfer private keys.
But of course there is always a battle between convince and security, so there were ways created to transfer encrypted private keys protected with a password.
And the same happened to passkeys.
I myself choose convenience over security in that regard and share my private keys and passkeys on my devices and thus am happy about that development.
The thing is, having options is often good, so a person should be able to choose passkeys in the secure way where you can invoke each device individually and never have the passkey to leave the device where it was generated. To achieve this, website need to allow multiple passkeys to be used, and would be expected from a bank, in my opinion. Maybe they think it is more secure to have just one passkey on one device, which it is, but how do you recover your account if that device dies?
There are already systems in place that allow temporary passkey sharing, for example with a QR code (CaBLE) https://www.corbado.com/blog/webauthn-passkey-qr-code
Doesn’t that imply you still have to open up your phone to temporarily share to your pc whenever you need it?
Yes but when you are logged in, you can add the passkey that belongs to the new device to your account
That doesn’t transfer the private key though (or at least it shouldn’t).
I’m pretty sure it’s just transferring public keys and signing the response with the private key on your phone.