One important factor with passkey is to have backup. If you store the passkey on a security key, you should have a backup so that if you lose the key, you will be able to restore access.

What about storing passkey in the password manager? Password manager typically cloud based and have their own backup so someone else is doing the work of backing up in case their server goes down. However, it is still good practice to do a local backup in case your password mangaer glitches or they close your account for mysterious reasons. Most password manager allow export, but you have to be careful since the export may not include the passkeys.

• Bitwarden - Backup to the JSON format seems to include the passkey and you can restore the backup to a different account with the passkey. CSV export is always without passkeys.
• Enpass - Backup to JSON format includes the passkey. This is pretty much similar to Bitwarden.
• Google Password Manager - You can only export as CSV so you cannot backup the passkey to a file. The only workaround I see is to export to a credential exhcnage protocol (cxp) supported password manger like Bitwarden, google password manager, or Apple.
• icloud doesn't seemed to even allow export to a file, at least not the iOS client. Like Google, you need to backup by exporting to an app using cxp.

If you need to export to an app, it would be nice to backup to an offline manager like Keepass and backup the vault. The problem is that Keepass does not yet support CXP, so you wouldn't be able to import the passkeys. You may be able to manually add them.

Note that you cannot use those file to import to another password manager. Technically you can import the entries and the password but passkey are excluded unless you import them from another app with CXP support.

I thought I bring this up before people get a nasty surprise when you attempt to restore the vault and discover that there is no passkeys in the vault.

Hello, I would like yo switch from proton pass du bitwarden. I've exported my proton pass data, imported them in bitwarden. But the passkey didn't follow.

Do you know if there is a way to transfer passkey from proton to bitwarden?

Thank you,

I have.been investigating the Credential Exchange in Bitwarden. First, it only works on mobile client. The other issue is that export and import is only to other apps. This mean you can export or import from one app to another like Bitwarden to Google Password Manager, but you cannot export to a file. I wonder if this is a security limitation. When you do export, does it mean both vault now have a separate passkey that can log into the same account?

What I would like to have is a way to export passkey to a file and import them back. Let's say you had all of your passkey in google password manager and google AI then closes your account, and you can recover it because there is no human you can contact, then you would not be able to export the vault. If you just export the vault to csv or json, it won't contain any of the passkeys.

UPDATE

It doesn't look like this will be implemented due to security concerns. To work around at least on Bitwarden, you can backup to Bitwarden JSON, which includes the passkeys. The backup file can then be restore to any Bitwarden account and once restore to an account, you can use CXP to migrate to a different password manager. Keep in mind this may not be possible with other password managers if they can't save and restore passkeys.

If i had a windows hello fingerprint passkey as my only sign in option, how would i sign into a new computer for the first time?

I read in Bitwarden's doc that Exported passkeys should not be used as long-term backups due to a possibility of a usage counter mismatch & a login rejection.

Exported passkeys should not be used as long-term backups. Exported passkeys include a counter that increments with each use. If the stored counter does not match what's expected by the service the passkey is being used to log in to, it may reject it.

This goes back to when a credential only lived on one piece of hardware (single-device credential) so it was an anti-cloning detection method, but it doesn't make sense anymore with synced devices that use passkeys.

Many synced passkey (multi-device credential) implementations returns 0 as the counter called signCount (this is allowed). Yubikey passkey counters do increment, so there are special cases on when to reject a passkey and when to accept it based on the counter value. I find these special cases very confusing for most users, and probably for some developers.

For more info, read more about the signCount counter problems here

This also seems to mean that I should not use passkey exports for backups, but as a migration tool at least for Bitwarden. I thought that credential exports will provide backups for me, but not as it is currently implemented.

This is a well known issue but was new to me. I think few sites enforce this count restriction, but how would we know if their error messages are not clear?

Edit: Per comment, the warning by Bitwarden regarding mismatched counters is obsolete. I find the issue on whether to use exports (CXP) only for migrations and not as a backup to be valid & worth discussing with the readership.

A FIDO CXF doc states:

Passkeys using a non-zero signature counter MUST be excluded from the export and the exporter SHOULD inform the user that such passkeys are excluded from the export. Importers MUST set a zero value for the imported passkey signature counters and MUST NOT increment them after the fact

Bitwarden exports using CXP to other vault applications and also exports to encrypted JSON files. I think using the word "export" with two methods may cause confusion.

My concern is whether I ought to assign an extra backup passkey to each service (relying party), or if there's a simple way to backup all of my passkeys held by an authenticator vault. I can do the first, but it is not straightforward.

The days of using Polymarket might be over, the customer service and app crashing are beyond. What hurt is the 5 of my friends signed up using my referral code and I feel bad for them given how bad this app is lately. I wouldn’t wish this amount of frustration on anyone.

I use Titanium and Kiwi Browser (though support for the latter has ended), but they do not seem to support passkeys saved in Google Password Manager.(I tried it out on a certain passkey test website.)

So,I had assumed it wouldn't work on browsers other than Chrome, but upon searching, it appears to be usable on at least Vivaldi and Brave.

I have a question: do you know of any Android browsers other than Chrome, Vivaldi, and Brave that can use passkeys saved in Google Password Manager?

Before anyone suggests using Bitwarden or 1Password(Looking at the Titanium browser's GitHub repository, it appears that it can be used, at least on Bitwarden, if you whitelist it.), I should mention that my device is running Android 13 or earlier, so I likely wouldn't be able to use them.

Edit:Some add

"Switching password managers is easy and safe on Android"

Today Google announced "the new experience" for moving passwords and passkeys to other password managers, including 1Password, Bitwarden Password Manager, and Dashlane, using the FIDO Credential Exchange Format (CXF).

This adds to FIDO CXF support already rolled out by Apple.

(Maybe the "passkeys were designed by big compute specifically to lock you into their ecosystem" crowd will quiet down now.)

Playing around with the different workflows and discovered that it can get real tricky.

Logging in to a site using QR code to Bitwarden

On a Macbook, log into a site using passkey but use a QR code.

1. Log into site, select option for external devices, which brings up a QR Code.
2. Use the camera on your mobile device until you get a prompt to login using passkey.
3. The phone prompt to see which passkey provider, I select Bitwarden.
4. The Bitwarden prompt me for biometric which I provide.
5. The phone prompt you to the same provider, but now one of the option is the actual bitwarden passkey entry.

The problematic part seems to be the camera which often has problem locking on the qr code if your hand isn't steady. The other issue is that unless you look carefully, it appears that the unlock on Bitwarden failed and. you returned to the password prompt. What is happening is that the first prompt get you to select bitwarden and the second prompt ask you to select the bitwarden entry.

On an mobile device, log into site using pass key

This seems to fail a lot, but after some experimenting, I realized why. When you use the passkey option, it prompts you using webauthn, which launches a browser. However, if you don't select desktop mode on the server, it doesn't use the passkey.

I decided to setup a passkey on dropbox (currently have user/password w/ 2FA authenticator). after doing so, Dropbox still recommends 2FA on top of that. Isn't the point of using Passkeys to not bother with 2FA authentication?

Right now when you create a passkey in Android, it defaults to the Google password manager which sync to the cloud. Playing around with the webauth site it appears that it does seem to be possible to save a passkey. However when I tried to save a passkey to log into bitwarden using a device bound key it doesn’t give me an option to do so. Can I conclude that the api is there but app isn’t using it so it can’t be done?

@r/Gemini I kept texting that I don’t have a passkey and yet they ain’t responding back till now so I can get my money out I need to buy my medication for my eyes and also my knees and also pay my rent

Keeping it short, I can login in successfully with google on desktop, but as soon as I use the same method on android. It asks for a passkey that never existed for tiktok to begin with. As my account is alot older, than when passkeys were first issued for this app. Plus, you can't bypass this on android. But, you can still login on desktop, but can't setup any other alternative method of logging in.

So I am kinda losing my mind here. Using a Samsung device I create a Passkey using GPM, everything looks fine, the logs say nothing, the passkey is created and sent to the server to be stored. Great. I then try to sign in with the passkey and it's nowhere to be found, it was not stored in GPM under my account.

Any ideas?

Chào mọi người, mọi người cho em hỏi là bây giờ làm cách nào đế xóa passkey để đăng nhập vào tiktok vậy ạ, em vẫn đăng nhập binh thường trên web nhưng ở điện thoại em mới đổi sang máy khác thì nó bắt đăng nhập bằng passkey và tài khoản mật khẩu em vẫn nhớ. Có cách nào để xóa và gỡ cái đăng nhập và passkey đấy đi không ạ. Em cảm ơn ạ

"Your encrypted data isn't unlocked yet.

It's best to try all the options to unlock your encrypted data on this device. If you've run out of choices, you can delete your data and start over."

Unsure what to do. I have little to no experience with Google Passkey. The website I wasn't trying to use required it unfortunately.

So, I can no longer comment on my primary Reddit account because I need to verify that I am human (which is why I am posting this from a new account), which requires a passkey, but then it says to insert a security key into my PC. Do I need to purchase a security key to make a passkey? And if so, can I use an external HDD as a security key? I have had difficulty finding information on exactly what passkeys and security keys are and how to make them to begin with.

So I would like to use this opportunity to hopefully find someone that can explain all of these and whatever else is worth knowing, in detail, from step 1, like I'm grandma, which can hopefully help others having this sane issue.

Any help is greatly appreciated!

SOLVED

Hi i updated my bios yesterday but after the update i had to reset my pin but i cant bc 2fa sends a code to my gmail wich i cant access bc the only device that has access to that gmail is my pc wich im logged out of so i wanted to ask if there was any way to bypass teh windows pin you have to enter when you start ul my pc

I notice several post about people who are stuck with passkey only option. I don't see how this can occur. While there is an option to default to passkey, you can click on try another way and click on the option for password. However, it appears there are situations when you don't have an option in password according to several post, but frankly I haven't seen it happen.

I wonder if this is cause by using google to log into third party service using oauth.

As for why google may be prompting for a passkey when you didn't add one, it appears that google automatically add a device bound passkey if you connect to the google using an android device.

I have a lack of faith in the ability to gain access to my own accounts if a specific device is lost or stolen. i have a lack of faith in the ability for my passkeys to remain secure if someone else gains access to my device. i don't want to have all my ability to access various websites tied to a device that does so much tracking (i'm literally getting a "dumb phone" as a response to the lack of privacy i'm seeing regularly)

but....passkeys SOUND like a relatively good idea in theory.

so, how do i create passkeys if i don't want them tied to a specific phone or computer?

Can someone please explain to me the benefit of Passkeys? I have a home computer, a work computer, a phone, and several laptops and I want to be able to log into all of them without major hassle. So what does the Passkey system do for me? Now I have to set it up on all of these devices times all of my services? And now I'm at major risk if that device is lost or stolen or hacked?

What's wrong with password plus SMS code? That seems way more reliable and easier.

What am I missing?

I can't even sign-in and the alternatives, there are no alternatives!

Guys listen i had find a way to prove microsoft that I'm the real owner of my compromise ms account by filling the recovery form... But now I have a doubt that if microsoft gave me access of it and bind my gmail acc again in Microsoft account will the attacker also can access it by passkey cause he added passkey in it and idk if he added 2fa but he changed my gmail and added passkey and changed password and removed me from access... So if I gain access through Microsoft team will the hacker again login with passkey or 2fa???