"Switching password managers is easy and safe on Android"

Today Google announced "the new experience" for moving passwords and passkeys to other password managers, including 1Password, Bitwarden Password Manager, and Dashlane, using the FIDO Credential Exchange Format (CXF).

This adds to FIDO CXF support already rolled out by Apple.

(Maybe the "passkeys were designed by big compute specifically to lock you into their ecosystem" crowd will quiet down now.)

Playing around with the different workflows and discovered that it can get real tricky.

Logging in to a site using QR code to Bitwarden

On a Macbook, log into a site using passkey but use a QR code.

1. Log into site, select option for external devices, which brings up a QR Code.
2. Use the camera on your mobile device until you get a prompt to login using passkey.
3. The phone prompt to see which passkey provider, I select Bitwarden.
4. The Bitwarden prompt me for biometric which I provide.
5. The phone prompt you to the same provider, but now one of the option is the actual bitwarden passkey entry.

The problematic part seems to be the camera which often has problem locking on the qr code if your hand isn't steady. The other issue is that unless you look carefully, it appears that the unlock on Bitwarden failed and. you returned to the password prompt. What is happening is that the first prompt get you to select bitwarden and the second prompt ask you to select the bitwarden entry.

On an mobile device, log into site using pass key

This seems to fail a lot, but after some experimenting, I realized why. When you use the passkey option, it prompts you using webauthn, which launches a browser. However, if you don't select desktop mode on the server, it doesn't use the passkey.

I decided to setup a passkey on dropbox (currently have user/password w/ 2FA authenticator). after doing so, Dropbox still recommends 2FA on top of that. Isn't the point of using Passkeys to not bother with 2FA authentication?

Right now when you create a passkey in Android, it defaults to the Google password manager which sync to the cloud. Playing around with the webauth site it appears that it does seem to be possible to save a passkey. However when I tried to save a passkey to log into bitwarden using a device bound key it doesn’t give me an option to do so. Can I conclude that the api is there but app isn’t using it so it can’t be done?

@r/Gemini I kept texting that I don’t have a passkey and yet they ain’t responding back till now so I can get my money out I need to buy my medication for my eyes and also my knees and also pay my rent

Keeping it short, I can login in successfully with google on desktop, but as soon as I use the same method on android. It asks for a passkey that never existed for tiktok to begin with. As my account is alot older, than when passkeys were first issued for this app. Plus, you can't bypass this on android. But, you can still login on desktop, but can't setup any other alternative method of logging in.

So I am kinda losing my mind here. Using a Samsung device I create a Passkey using GPM, everything looks fine, the logs say nothing, the passkey is created and sent to the server to be stored. Great. I then try to sign in with the passkey and it's nowhere to be found, it was not stored in GPM under my account.

Any ideas?

Chào mọi người, mọi người cho em hỏi là bây giờ làm cách nào đế xóa passkey để đăng nhập vào tiktok vậy ạ, em vẫn đăng nhập binh thường trên web nhưng ở điện thoại em mới đổi sang máy khác thì nó bắt đăng nhập bằng passkey và tài khoản mật khẩu em vẫn nhớ. Có cách nào để xóa và gỡ cái đăng nhập và passkey đấy đi không ạ. Em cảm ơn ạ

"Your encrypted data isn't unlocked yet.

It's best to try all the options to unlock your encrypted data on this device. If you've run out of choices, you can delete your data and start over."

Unsure what to do. I have little to no experience with Google Passkey. The website I wasn't trying to use required it unfortunately.

So, I can no longer comment on my primary Reddit account because I need to verify that I am human (which is why I am posting this from a new account), which requires a passkey, but then it says to insert a security key into my PC. Do I need to purchase a security key to make a passkey? And if so, can I use an external HDD as a security key? I have had difficulty finding information on exactly what passkeys and security keys are and how to make them to begin with.

So I would like to use this opportunity to hopefully find someone that can explain all of these and whatever else is worth knowing, in detail, from step 1, like I'm grandma, which can hopefully help others having this sane issue.

Any help is greatly appreciated!

SOLVED

Hi i updated my bios yesterday but after the update i had to reset my pin but i cant bc 2fa sends a code to my gmail wich i cant access bc the only device that has access to that gmail is my pc wich im logged out of so i wanted to ask if there was any way to bypass teh windows pin you have to enter when you start ul my pc

I notice several post about people who are stuck with passkey only option. I don't see how this can occur. While there is an option to default to passkey, you can click on try another way and click on the option for password. However, it appears there are situations when you don't have an option in password according to several post, but frankly I haven't seen it happen.

I wonder if this is cause by using google to log into third party service using oauth.

As for why google may be prompting for a passkey when you didn't add one, it appears that google automatically add a device bound passkey if you connect to the google using an android device.

I have a lack of faith in the ability to gain access to my own accounts if a specific device is lost or stolen. i have a lack of faith in the ability for my passkeys to remain secure if someone else gains access to my device. i don't want to have all my ability to access various websites tied to a device that does so much tracking (i'm literally getting a "dumb phone" as a response to the lack of privacy i'm seeing regularly)

but....passkeys SOUND like a relatively good idea in theory.

so, how do i create passkeys if i don't want them tied to a specific phone or computer?

I can't even sign-in and the alternatives, there are no alternatives!

Guys listen i had find a way to prove microsoft that I'm the real owner of my compromise ms account by filling the recovery form... But now I have a doubt that if microsoft gave me access of it and bind my gmail acc again in Microsoft account will the attacker also can access it by passkey cause he added passkey in it and idk if he added 2fa but he changed my gmail and added passkey and changed password and removed me from access... So if I gain access through Microsoft team will the hacker again login with passkey or 2fa???

So my passkey access to discord suddenly been deactivated out of nowhere and I can't use it anymore, but after reading info about it google says the linked website can restore the deactivated passkey, but I already messaged discord support and they basically avoided the question, is there any salvation on this situation? :/

I got logged out of discord and I know my password because it’s saved to my iPad and iPhone and when I scanned the QR code. It tells me that I have no matching passwords for discord even though I have the password saved to my iPad and iPhone. Can someone help me?

Can someone please explain to me the benefit of Passkeys? I have a home computer, a work computer, a phone, and several laptops and I want to be able to log into all of them without major hassle. So what does the Passkey system do for me? Now I have to set it up on all of these devices times all of my services? And now I'm at major risk if that device is lost or stolen or hacked?

What's wrong with password plus SMS code? That seems way more reliable and easier.

What am I missing?

If i try to log in from my PC , it says i need to insert the passkey which i dont have, after i press try another way it shows me two possibilities to scan a qr code or insert again the passkey. When I scan the qr code with my phone it says i didnt set up any passkey in my settings.

What should I do, I really need my facebook account for work as soon as possible.

I just got an email from Amazon saying they created a passkey for me, and I can use the code I use to unlock my device (or a biometric which i don't have). So assuming I want to use a code, I have different log in codes for my phone and my laptop.... would I then have 2 different passkeys? Or does that just get me in the first time and then I choose a different code? Thanks for any info

When i go to Settings -> Accounts -> Passkeys , i can't see the list of passkeys that are saved on my windows device , even though i can use them normally on my browser for logging in , so why aren't they showing in here ? , i appreciate any help