244
Passkeys are a trap. Do not use them (nonfunctional.substack.com)
submitted 1 month ago by to c/privacy@lemmy.ml
177 comments fedilink hide all child comments
 

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] -1 points 1 month ago (10 children)

The Bitwarden client is so bad though. I seem to only be able to use the passkey on the specific device I saved it in.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 13 points 1 month ago (2 children)

    I've experimented with this and haven't had a problem. However, I was using the open source fork Vaultwarden and only the browser extension(s).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 month ago* (1 child)

    I am using the same combination, but the passkeys do not persist between different browsers

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 month ago

    In the bitwarden browser extension, settings -> autofill -> "make bitwarden your default password manager"

    Is this checked?

    I also set a "pin" in settings -> account security -> "unlock with pin".

    (After reading the article: maybe passkey requires bitwarden to be "more secure" - I dunno)

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 month ago* (3 children)

    Hmm I haven't had that issue, I have a lot of passkeys saved and they sync fine and are usable in Firefox on my laptop as well as with apps on my pixel 5 running lineage. I have noticed that occasionally an app will refuse to give me the option to create a passkey in bitwarden, but I just skip those and I haven't noticed that issue in a while.

    Have you checked whether the site entry shows the passkey on both devices? On mine it'll say "passkey created ..." on both devices in the vault.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 1 month ago (2 children)

    The main problem is that there's no place to view my passkeys like there is for passwords for TOTP (according to my searching and their website, anyway)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 1 month ago

    In vaultwarden, they do appear in the web client. The behavior you're describing hints that your passkeys are not being stored in bitwarden.

    ...and tbh, the UX sucks pretty bad: I was trying to store a passkey in bitwarden, but it was failing (unrelated networking error). I had two options: add it to bitwarden (which failed) or cancel. I hit cancel and was prompted for my fingerprint, which I provided -- this ended up storing it on my device... no input, no description of what it was doing. The website came back with "passkey now enabled" :facepalm:

  • permalink
  • fedilink
  • source
  • parent