Lack of transparency and communication regarding the exportability of passkeys and the security model of 1Password

Signals over time

3 observed signals across 1 sources, tracked for 2 days. Confidence: low.

What people are saying Observed

• “> no one supported exporting passkeys at the time and I believe the only ones who supported passkey sharing of any kind was Apple What exactly is the practical difference between "sharing" a key and "exporting" it? As it is, Apple's Passwords app as of today absolutely allows importing and exporting of Passkeys ("Transfer to another app"). > I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time. This is a very diplomatic presentation. This was in Tim's very first reply: > To be very honest here, you risk having KeePassXC blocked by relying parties (similar to #10406). > I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking a”

  Hacker News · frustration

• “>if they didn't remove sharing/export functionality that Google, Apple and others had at the same time. This is factually incorrect — no one supported exporting passkeys at the time and I believe the only ones who supported passkey sharing of any kind was Apple: https://support.apple.com/guide/iphone/share-passwords-iphe6... What that Keepass X GitHub PR comment section was discussing was giving users a way to export their passkeys to an unencrypted file on disk, which would have allowed for attackers to convince non-technical users to export all their passkeys and then send them to an attacker. I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time. https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20240522.html Fast forward to today... and it looks like there's movement towards doing exactly that: https://github.com/keepassxreboot/keepassxc/pull/13343 -- Edit: Indeed if you scroll down to the last com”

  Hacker News · complaint

• “1Password suddenly offering to save passkeys without mentioning that they can't be exported to other apps (but are seamlessly synced between devices using 1Password) is what lost them "good guys" status in my mind. It immediately creates a huge lock-in in a hard-to-notice way. Luckily, I did noticed early on and manually removed the 20 or so passkeys I had created. Earlier this year, I lost my iPhone and restored from backup. I was shocked to see that I could log into my 1Password account using only the master-key, and that the secret-key was not required. 1Password clearly stated that the secret-key was required to setup a new device, but it turns out that they also (perhaps recently) configure it to upload to all devices in your iCloud account[1]. Ever since then, I've lost faith in 1Password's ability to communicate their security model to me and started looking for an off-ramp. [1] https://support.1password.com/secret-key-security/”

  Hacker News · complaint