The article does talk about how tools like 1Password could allow for PassKey sharing without vendor lock-in.

Allowing each tenant to move thousands of highly-sensitive internal tokens to a competitor is something the credit card processing industry, somewhat surprisingly, has more or less solved. Most credit card gateways that store card information on file in a PCI compliant way will allow a merchant to specify another competing PCI compliant service provider, and will export the merchant's information directly to the new service provider in bulk, without needing to provide any of the raw information to the merchant themself.

Via https://www.chargebee.com/blog/credit-card-portability-impor... it seems Braintree developed an industry standard for this in ~2010, potentially (I don't know the history) as a way to force Stripe to allow its merchants to move elsewhere in the ecosystem without holding their cards-on-file hostage. Based on the list at https://docs.spreedly.com/guides/exporting/ - all of whom support this workflow - it seems this was quite successful.

Ironically, the standardization site has been down since 2019, but I suppose it was no longer needed. https://web.archive.org/web/20190212151438/http://www.portab...

Its guiding light was to be "patterned after telephone number portability that was part of the 1996 Telecommunications Act" - which is quite telling in this context.

Point is, there is precedent for developing frameworks in which secure token storage platforms can allow you to freely move between them, with secure bulk data transfers. Apple and Google would do well to get ahead of this, lest it become a regulatory or PR nightmare later when high-profile stories accuse them of intentionally promoting lock-in.

Currently, managing and using close to a 1,000 passwords, all around 35 characters and completely random, is an absolute breeze using 1Password (and likely any password manager of choice) and my data is securely stored in a cloud I can access from any device (and from my neighbor's laptop if disaster should strike).

No way that I am handing over this functionality to a bunch of private keys that I can only access when logged in using a device from one specific vendor.

The security benefits are vastly less than the loss in portability/emergency use.

So the idea of passkeys is fantastic, but as long as I cannot store them in a central platform agnostic place, it's passwords for me.

That being said, I was hoping to see more touch ID webauthn so I'm not super hopeful. But we can hope!

For starters, it doesn't release any secret information into the wild. Instead, it uses a public/private key pair to challenge the user to decrypt something that only she or he can decrypt. The website (as an example) no longer stores anything but your public key, which doesn't reveal anything.

Secondly, you can't give away your passkey information so it is for all practical purposes unphishable. (I can't conceive of a way that it might be phished, but that doesn't mean there isn't one.)

In addition, it is super-duper easy on users. They don't have to remember anything, and can login with the touch of a finger or a glance at the camera.

This is a huge step forward in authentication.

I mean it's just Webauthn under the hood, I'd bet money you can export them from keychain into another tool like 1Password or similar.