Hacker News Reader

Comment by syhol | Hacker News Reader

My passkeys are kept in my password manager. Many support them now: 1Password, Keeper, Dashlane, BitWarden, and I know KeePassX is working on support.

Sure it's not as secure as a hardware token but it's a nice sweet spot between convenience and security.

However I wish more platforms let me use TOTP and passkeys together for MFA. That way I don't need to put all my trust in a single password manager company. 2FAS with it's browser plugin gives a really slick experience and it backups to Google/Apple storage with a separate password to encrypt your OTP secret keys.

View on HN

KeePassXC supports them in their latest stable version as of last week [0].

[0]: https://keepassxc.org/blog/2024-03-10-2.7.7-released/

Bitwarden still doesn't support it on mobile, where it would probably the most useful, partially because Bitwardens auto fill on android is extremely unreliable, especially when dealing with two login pages (email then password).

Bitwarden doesn't have support in apps, but you can get passkey support in Firefox by installing the Bitwarden addon.

I would've preferred more integration here (because unlocking the app vault doesn't unlock the addon vault, for example) but I think this is just because of the lack of proper APIs for this kind of thing. Android's auto fill API is using the standard system API, but the system API clearly isn't designed for the "enter your username, hit next, then enter your password" flow.

I'm sure you mean KeePassXC? KeePassX has been dead for years.

Yes, my bad.

KeePassXC added support for passkeys in 2.7.7, released a week ago:

https://keepassxc.org/blog/2024-03-10-2.7.7-released/

This post prompted me to give it a try at webauthn.io.

Passkey support is disabled by default, so you have to enable it in the settings for the browser extension. After that, the UI seems reasonable enough. It creates an entry with a "Passkey" tag, where the Password field is empty, and the credentials are stored as additional attributes on the Advanced tab.

One thing I'm not sure about: although the extension has a setting to fall back to the browser's own passkey support, when I dismissed the KeePassXC prompt, I did not get a prompt from Firefox.

The fallback should be fixed in extension version 1.9.0.2.

> Passkey support is disabled by default

Thank, I hadn't noticed that, I thought I had to wait for the extension to be updated after the announcement from KeepassXC.

> After that, the UI seems reasonable enough.

I tried it on webauthn.io and I'm wondering if there's a point in showing a prompt on every login attempt, if passkeys are phishing proof. Why not just allow the login right away? Maybe show a notification that it happened, but why wait for user confirmation?

Reply on news.ycombinator.com