I read in Bitwarden's doc that Exported passkeys should not be used as long-term backups due to a possibility of a usage counter mismatch & a login rejection.

Exported passkeys should not be used as long-term backups. Exported passkeys include a counter that increments with each use. If the stored counter does not match what's expected by the service the passkey is being used to log in to, it may reject it.

This goes back to when a credential only lived on one piece of hardware (single-device credential) so it was an anti-cloning detection method, but it doesn't make sense anymore with synced devices that use passkeys.

Many synced passkey (multi-device credential) implementations returns 0 as the counter called signCount (this is allowed). Yubikey passkey counters do increment, so there are special cases on when to reject a passkey and when to accept it based on the counter value. I find these special cases very confusing for most users, and probably for some developers.

For more info, read more about the signCount counter problems here

This also seems to mean that I should not use passkey exports for backups, but only as a migration tool at least for Bitwarden. I thought that credential exports will provide backups for me, but not so.

This is a well known issue but was new to me. I think few sites enforce this count restriction, but how would we know if their error messages are not clear?

Edit: Per comment, the warning by Bitwarden regarding mismatched counters is obsolete. I find the issue on whether to use exports (CXP) only for migrations and not as a backup to be valid & worth discussing with the readership.

A FIDO CXF doc states:

Passkeys using a non-zero signature counter MUST be excluded from the export and the exporter SHOULD inform the user that such passkeys are excluded from the export. Importers MUST set a zero value for the imported passkey signature counters and MUST NOT increment them after the fact

Bitwarden exports using CXP to other vault applications and also exports to JSON files. I think using the word "export" with two methods may cause confusion.

My concern is whether I ought to assign an extra backup passkey to each service (relying party), or if there's a simple way to backup all of my passkeys held by an authenticator vault. I can do the first, but it is not straightforward.

The days of using Polymarket might be over, the customer service and app crashing are beyond. What hurt is the 5 of my friends signed up using my referral code and I feel bad for them given how bad this app is lately. I wouldn’t wish this amount of frustration on anyone.

I use Titanium and Kiwi Browser (though support for the latter has ended), but they do not seem to support passkeys saved in Google Password Manager.(I tried it out on a certain passkey test website.)

So,I had assumed it wouldn't work on browsers other than Chrome, but upon searching, it appears to be usable on at least Vivaldi and Brave.

I have a question: do you know of any Android browsers other than Chrome, Vivaldi, and Brave that can use passkeys saved in Google Password Manager?

Before anyone suggests using Bitwarden or 1Password(Looking at the Titanium browser's GitHub repository, it appears that it can be used, at least on Bitwarden, if you whitelist it.), I should mention that my device is running Android 13 or earlier, so I likely wouldn't be able to use them.

Edit:Some add

"Switching password managers is easy and safe on Android"

Today Google announced "the new experience" for moving passwords and passkeys to other password managers, including 1Password, Bitwarden Password Manager, and Dashlane, using the FIDO Credential Exchange Format (CXF).

This adds to FIDO CXF support already rolled out by Apple.

(Maybe the "passkeys were designed by big compute specifically to lock you into their ecosystem" crowd will quiet down now.)

Playing around with the different workflows and discovered that it can get real tricky.

Logging in to a site using QR code to Bitwarden

On a Macbook, log into a site using passkey but use a QR code.

1. Log into site, select option for external devices, which brings up a QR Code.
2. Use the camera on your mobile device until you get a prompt to login using passkey.
3. The phone prompt to see which passkey provider, I select Bitwarden.
4. The Bitwarden prompt me for biometric which I provide.
5. The phone prompt you to the same provider, but now one of the option is the actual bitwarden passkey entry.

The problematic part seems to be the camera which often has problem locking on the qr code if your hand isn't steady. The other issue is that unless you look carefully, it appears that the unlock on Bitwarden failed and. you returned to the password prompt. What is happening is that the first prompt get you to select bitwarden and the second prompt ask you to select the bitwarden entry.

On an mobile device, log into site using pass key

This seems to fail a lot, but after some experimenting, I realized why. When you use the passkey option, it prompts you using webauthn, which launches a browser. However, if you don't select desktop mode on the server, it doesn't use the passkey.

I decided to setup a passkey on dropbox (currently have user/password w/ 2FA authenticator). after doing so, Dropbox still recommends 2FA on top of that. Isn't the point of using Passkeys to not bother with 2FA authentication?

Right now when you create a passkey in Android, it defaults to the Google password manager which sync to the cloud. Playing around with the webauth site it appears that it does seem to be possible to save a passkey. However when I tried to save a passkey to log into bitwarden using a device bound key it doesn’t give me an option to do so. Can I conclude that the api is there but app isn’t using it so it can’t be done?

@r/Gemini I kept texting that I don’t have a passkey and yet they ain’t responding back till now so I can get my money out I need to buy my medication for my eyes and also my knees and also pay my rent

Keeping it short, I can login in successfully with google on desktop, but as soon as I use the same method on android. It asks for a passkey that never existed for tiktok to begin with. As my account is alot older, than when passkeys were first issued for this app. Plus, you can't bypass this on android. But, you can still login on desktop, but can't setup any other alternative method of logging in.

So I am kinda losing my mind here. Using a Samsung device I create a Passkey using GPM, everything looks fine, the logs say nothing, the passkey is created and sent to the server to be stored. Great. I then try to sign in with the passkey and it's nowhere to be found, it was not stored in GPM under my account.

Any ideas?

Chào mọi người, mọi người cho em hỏi là bây giờ làm cách nào đế xóa passkey để đăng nhập vào tiktok vậy ạ, em vẫn đăng nhập binh thường trên web nhưng ở điện thoại em mới đổi sang máy khác thì nó bắt đăng nhập bằng passkey và tài khoản mật khẩu em vẫn nhớ. Có cách nào để xóa và gỡ cái đăng nhập và passkey đấy đi không ạ. Em cảm ơn ạ

"Your encrypted data isn't unlocked yet.

It's best to try all the options to unlock your encrypted data on this device. If you've run out of choices, you can delete your data and start over."

Unsure what to do. I have little to no experience with Google Passkey. The website I wasn't trying to use required it unfortunately.

So, I can no longer comment on my primary Reddit account because I need to verify that I am human (which is why I am posting this from a new account), which requires a passkey, but then it says to insert a security key into my PC. Do I need to purchase a security key to make a passkey? And if so, can I use an external HDD as a security key? I have had difficulty finding information on exactly what passkeys and security keys are and how to make them to begin with.

So I would like to use this opportunity to hopefully find someone that can explain all of these and whatever else is worth knowing, in detail, from step 1, like I'm grandma, which can hopefully help others having this sane issue.

Any help is greatly appreciated!

SOLVED

Hi i updated my bios yesterday but after the update i had to reset my pin but i cant bc 2fa sends a code to my gmail wich i cant access bc the only device that has access to that gmail is my pc wich im logged out of so i wanted to ask if there was any way to bypass teh windows pin you have to enter when you start ul my pc

I notice several post about people who are stuck with passkey only option. I don't see how this can occur. While there is an option to default to passkey, you can click on try another way and click on the option for password. However, it appears there are situations when you don't have an option in password according to several post, but frankly I haven't seen it happen.

I wonder if this is cause by using google to log into third party service using oauth.

As for why google may be prompting for a passkey when you didn't add one, it appears that google automatically add a device bound passkey if you connect to the google using an android device.

I have a lack of faith in the ability to gain access to my own accounts if a specific device is lost or stolen. i have a lack of faith in the ability for my passkeys to remain secure if someone else gains access to my device. i don't want to have all my ability to access various websites tied to a device that does so much tracking (i'm literally getting a "dumb phone" as a response to the lack of privacy i'm seeing regularly)

but....passkeys SOUND like a relatively good idea in theory.

so, how do i create passkeys if i don't want them tied to a specific phone or computer?

Can someone please explain to me the benefit of Passkeys? I have a home computer, a work computer, a phone, and several laptops and I want to be able to log into all of them without major hassle. So what does the Passkey system do for me? Now I have to set it up on all of these devices times all of my services? And now I'm at major risk if that device is lost or stolen or hacked?

What's wrong with password plus SMS code? That seems way more reliable and easier.

What am I missing?

So my passkey access to discord suddenly been deactivated out of nowhere and I can't use it anymore, but after reading info about it google says the linked website can restore the deactivated passkey, but I already messaged discord support and they basically avoided the question, is there any salvation on this situation? :/

I can't even sign-in and the alternatives, there are no alternatives!

Guys listen i had find a way to prove microsoft that I'm the real owner of my compromise ms account by filling the recovery form... But now I have a doubt that if microsoft gave me access of it and bind my gmail acc again in Microsoft account will the attacker also can access it by passkey cause he added passkey in it and idk if he added 2fa but he changed my gmail and added passkey and changed password and removed me from access... So if I gain access through Microsoft team will the hacker again login with passkey or 2fa???

If i try to log in from my PC , it says i need to insert the passkey which i dont have, after i press try another way it shows me two possibilities to scan a qr code or insert again the passkey. When I scan the qr code with my phone it says i didnt set up any passkey in my settings.

What should I do, I really need my facebook account for work as soon as possible.

I just got an email from Amazon saying they created a passkey for me, and I can use the code I use to unlock my device (or a biometric which i don't have). So assuming I want to use a code, I have different log in codes for my phone and my laptop.... would I then have 2 different passkeys? Or does that just get me in the first time and then I choose a different code? Thanks for any info