New Passkey Specifications Will Let Users Import and Export Them

9to5Mac's Filipe Esposito reports: Passkeys were introduced two years ago, and they replace traditional passwords with more secure authentication using a security key or biometrics. To make the technology even better, the FIDO Alliance published on Monday new specifications for passkeys, which ensure a way to let users import and export them. Currently, there's no secure way to move passkeys between different password managers. For example, if you've stored a specific passkey in Apple's Passwords app, you can't simply move it to 1Password, or vice versa. But that will change soon.

As just announced by the FIDO Alliance, the new specifications aim to promote user choice by offering a way to import and export passkeys. The draft of the new specifications establishes the Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) formats for transferring not only passkeys, but other types of credentials will also be supported. The new formats are encrypted, which ensures that credentials remain secure during the process. For comparison, most password managers currently rely on CSV files to import and export credentials, which is much less secure.

Good and bad

[NotEmmanuelGoldstein]

... import and export them.

The inability to copy passkeys was originally touted as a benefit. Unfortunately that means, there always needs to be less secure means of authentication because hardware-based authentication must be replaced, sooner or later. This fixes that problem, returning us to all the old problems with authentication technology.

... formats for transferring not only passkeys, but other types of credentials ...

We've had TOTP for 12 years, why did it take so long to make a necessary and much-needed inter-change standard?

Re:

[ctilsie242]

TOTP, as in Google Authenticator does have the ability to do backups, as it is just a shared secret. Most PW managers allow easy export and backups of that.

PassKeys, on the other hand, are public/private keys. Unlike TOTP, where the hashing is symmetric, the security with PassKeys is public key. It also is highly resistant against phishing attempts [apple.com]. Normally they are bound to devices and can't get backed up. However, some apps like 1Password can back those up and allow them to work on different hardwar

Re:

[ls671]

What could possibly go wrong indeed?

Re:

[Cobalt Jacket]

"Non-exportable passkeys" are pretty simple: Use a YubiKey. The 5C NFC works on pretty much everything, and in most cases, is indistinguishable from a software passkey.

Less Secure

[Sir Realist]

"...CSV files to import and export credentials, which is much less secure."

I was trying to come up with a joke, but I got nothin funnier than that titan of an understatement.

Re:

[jddj]

...or alternatively in raw SQL";DROP TABLE passkeys;

Now maybe Apple will quit badgering me...

[jddj]

...to turn on iCloud keychain, which i #donotwant