HNHacker News
TopNewBestAskShowJobs

protonpass

1 karma · joined March 31, 2023

submissionscomments
protonpass··on Big Tech passkey implementations are a trap
Hi there, it is up to individual websites whether they require passkeys or passkeys + 2FA etc..

It is also important to note that most attacks are phishing-based, and passkeys are phishing-resistant, and will only work on the originating website.

Proton Sentinel also helps to protect account takeovers, even when an attacker has stolen your password.

protonpass··on Big Tech passkey implementations are a trap
You can already export and reimportant passkeys in Proton Pass and as soon as an industry-wide export format is standardized, we'll support that too.
protonpass··on Big Tech passkey implementations are a trap
Proton Pass allows you to export and reimport passkeys. An industry-wide standard for exports is not yet finalized, but as soon as it is, we'll support that too.

Regarding passkey implementation, it's up to individual websites whether they use passkey or passkey + 2FA, etc..

protonpass··on Big Tech passkey implementations are a trap
Hi there, from: https://developers.google.com/identity/passkeys/supported-en...

"Chrome on macOS 13.5 and later can use iCloud Keychain to store passkeys. Passkeys in iCloud Keychain are synchronized across the user's Apple devices and can be used by other browsers and apps.

Chrome on macOS can also store passkeys in a local profile, which means they aren't synchronized to other devices. Storing passkeys in a local profile is available in earlier versions of macOS."

protonpass··on Big Tech passkey implementations are a trap
Passkeys on supported websites provide a simpler/streamlined experience vs passwords as they are automatically generated and strong/unique by default without requiring the user to manage the strength of each and every password that they create.

They are also phishing-resistant, which means if a user mistypes a website and lands on a phishing website, the passkey will not work, where a password would expose private credentials.

Passkeys are also exported/reimported in Proton Pass just like regular passwords without any additional work, and as soon as an industry standard for backups is finalized, we'll support that too. They can also be included in shared vaults.

protonpass··on Big Tech passkey implementations are a trap
Thanks for the feedback! Passkeys also provide the benefit of being phishing resistant and will only work on the originating website.
protonpass··on Big Tech passkey implementations are a trap
Thanks for the feedback! You can currently export and reimport passkeys in Proton Pass (for backups) and as soon as an industry standard is finalized, we'll support that format too.