What are some best practices for portability of passkeys?
I've built me a little password manager (namely https://github.com/conradkleinespel/rooster) and wonder if I could make it support passkeys, at least as a backup solution to the likes of 1Password.
While I totally get the usefulness of passkeys, I feel like having a backup of some sort is needed, in case the device breaks, gets stolen, etc.
About time Google decided to catch up to Apple, 1Password, etc.
Their cross-comparison of vendors toward the end is pretty disingenuous. For starters: authentication entries stored in iCloud Keychain aren't "natively" accessible to Firefox and Chrome users on MacOS. Apple does officially distribute a Chrome extension to make them accessible, but as far as I'm aware there's no way to get at them from Firefox. This would make the cross-comparison for iCloud look much more like the third party password manager column.
On multiple occasions they mention the "Passwords App coming to Windows"; this is entirely supposition. Apple has said nothing about this, period. Yes, they have passwords available in iCloud for Windows, but its missing a ton of functionality, loses authentication with your Apple account constantly, and is overall an unusable experience.
Nothing being stated in this article is new, nothing Google is adding is even new let alone "groundbreaking" (their words), applications like 1Password have had this for what must be nearing a year now. But, my suspicion is that Corbado, whoever they are, wouldn't want to talk too much about the capabilities of 1Password, because they directly compete with one-another [1].
There's still no standard exports/backup formats, yeah?
Some previous comments made me think there was an acknowledgement that this had to come, that trust us to store and manage this for you wasn't going to be enough, was blocking adoption/acceptance so heavily that the security upsides were starting to look irrelevant.
I think that's quite an interesting strategic move which could have tremendous impact on the whole passkeys provider / password manager ecosystem.
What do you think will be Apple's next move?
Is it groundbreaking? 1Password hasn't done this for some time now?
For that matter, 1Password offers site devs an ability to accept passkeys:
https://passage.1password.com/product/passkey-complete
This isn't last generation's 1Password "app", they've been on a tear last few years in turning into a "platform". Explore the dev docs for CLI tooling, integrations, more, and it all works for teams (including with SSO no less) not just individuals.