🔑 Huge news! Google’s announced that passkeys are available in Google Chrome 108. So we have iOS, iPadOS, macOS, Safari, and Chrome with support.

If you’re responsible for a website or app, or its authentication story, it’s time to look at passkeys. https://blog.chromium.org/2022/12/introducing-passkeys-in-chrome.html

Introducing passkeys in Chrome

We announced in October that passkey support was available in Chrome Canary. Today, we are pleased to announce that passkey support is now ...

Chromium Blog
@rmondello heck yeah! Passkeys can’t arrive fast enough!
@rmondello iCloud passwords for Chrom[ei][um] next <3
@rmondello I noticed that “simply” implementing the WebAuthn standard for security keys and biometrics results in automatic Passkey support. Is this correct?
@rmondello @lexpostma as I understand it, for the most part - yes. You may need to do extra legwork to make it fully passwordless as opposed to just a 2FA option though
@faisal @rmondello ah yes of course, to make it truly passwordless more work needs to be done. But it stood out to me that all the system dialogs just used the Passkey words for the same things as where in the 2FA dialogs before

@rmondello Glad its finally here.

And something I've long been interested in implementing, but I get the impression I can't adhear to W3C's specs since they're JS APIs...

@rmondello i’m waiting for @bitwarden support.
@hmiron @rmondello The team is working on passkey support! Currently you can use a passkey on iOS for example to authenticate into the web vault itself. The team will continue to research and develop open solutions for passkey storage and retrieval 👍
@rmondello I just put in the request at my employer that we look into supporting passkeys on our site!
@rmondello very cool! am I correct in assuming that I'll need something like 1Password to get cross-platform/cross-browser support? I guess I could also just use Chrome on iOS assuming I use Chrome on other platforms?
@rmondello @nsa why would I implement something that relies on a user owning a specific device constantly? Not only can a phone be confiscated but some people don't have consistent computer access. Can the keys even be transferred to another device or duplicated?

@gaycodegal @rmondello you can sync your passkey across devices of the same sync provider. And you can register as many devices of different providers as you want with each website.

Using a passkey requires passing a phone unlock. If confiscation is in your threat model you can set a strong factor like a PIN or password as your lockscreen.

Third party provider support in the roadmap for Google -- 1password & dashlane are already experimenting with implementations.

@nsa @rmondello there is no open source provider?
@gaycodegal @rmondello @nsa this! I haven't trusted my yubikeys fully because if this. What if it breaks? :(

@gaycodegal @rmondello @nsa

Yes, this is not just a problem at a boarder crossing, but when police sweep the encampments of homeless people, they'll take or smash phones (which may be left for safekeeping or charging.)

@emmah @rmondello @nsa yeah this was more what I was getting at. Homeless folk complained a lot about mandatory 2fa and this seems less portable than that
@rmondello afraid to look to see if Cognito has support.
@rmondello how about an iOS Mastadon client w passkey support, @JPEGuin ?

@rmondello @siracusa but… when are they going to be supported on their own actual user sites?

I keep waiting to be able to convert my accounts but… 😔

@rmondello I’m on-and-off working on a side project which uses Passkeys as its only auth mode. Really impressed by the tech and what it enables for both end users and developers.

@rmondello Excellent!

(I try to stay away from everything Google myself, but I hope this is a stepping stone for better passkey adaption by sites/services)

@rmondello

"Google has long recognized these issues, which is why we have created defenses like 2-Step Verification"

Dear Google, 2FA was patented by AT&T in 1989 😉

@rmondello Unfortunately, Linux is not supported without a phone and the ability to scan a QR code.

https://developers.google.com/identity/passkeys/supported-environments

Passkey support on Android and Chrome  |  Authentication  |  Google for Developers

Google for Developers
@rmondello Woo, finally! Only thing (which I don't expect you to answer - more of a general observation 😁) -- do these passkeys sync with the passkeys I have in Safari with iCloud keychain? 👀
@rmondello That's great to hear! We now have iOS/iPadOS, Chrome, ... still a bit of a way to go with Android and Linux though. Should make using password (passkey-) managers easier to use and set up in the long term. Looking forward to that :)

@rmondello the question, and it’s not original to me, seems to be whether anyone has implemented them portably. I.e, if I have an android phone and switch to iPhone (or vice versa) is there a way to move my keys yet?

Or an I still stuck having to set up s as parallel set of keys/accounts?

@rmondello having recently worked on both client and server side WebAuthn solutions this is fantastic news