Passkeys make plausible deniability more difficult. “This user name isn’t necessarily associated with my real world identity” permits some important good things.
The kicker is this used to be solved with passwordless webauthn, the same standard, until some morons decided that resident keys were the way to go (they aren’t)
Are you sure? TOTP secrets can be exported. I think passkey implementations explicitly prevent that. Unless I’m missing an option to export passkey creds, e.g. print them out.
That same disaster recovery feature (which I need) also helps avoid a future where every forum and avenue of dissent requires dis-repudiation via passkeys. It’s a weird nuance, ascribing a social effect to a simple ability to back up your keys without backing up your whole phone.
Passkeys can be synchronized, but aren’t intended to be exported raw as they’re meant to be used with a TPM / secure element chip or equivalent secure hardware to protect the key in use. Bitwarden can synchronize them.
Also, they intentionally create distinct keys per site, so you can’t link multiple accounts using the same passkey / hardware security key.
Passkeys make plausible deniability more difficult. “This user name isn’t necessarily associated with my real world identity” permits some important good things.
The kicker is this used to be solved with passwordless webauthn, the same standard, until some morons decided that resident keys were the way to go (they aren’t)
Passkeys use unique keys per site for that reason
How does that protect against “only you could have logged in because this passkey is only on your phone”?
That’s literally no different from a regular password manager or having a 2FA TOTP code app set up for it
Are you sure? TOTP secrets can be exported. I think passkey implementations explicitly prevent that. Unless I’m missing an option to export passkey creds, e.g. print them out.
That same disaster recovery feature (which I need) also helps avoid a future where every forum and avenue of dissent requires dis-repudiation via passkeys. It’s a weird nuance, ascribing a social effect to a simple ability to back up your keys without backing up your whole phone.
Passkeys can be synchronized, but aren’t intended to be exported raw as they’re meant to be used with a TPM / secure element chip or equivalent secure hardware to protect the key in use. Bitwarden can synchronize them.
Also, they intentionally create distinct keys per site, so you can’t link multiple accounts using the same passkey / hardware security key.