Passkeys and Bitwarden

ChilliBob

Hey guys, 

Does anyone use the combination of passkeys and Bitwarden? I thought I'd dip my toe into passkeys by adding them to an Outlook account which isn't very important.

Worked fine on desktop mode, with Bitwarden storing the passkey (and perhaps the laptop?), but on my Android phone a different story.

First Chrome tried to use Google to find a passkey, which it didn't have. So I tried to use Bitwarden as the autofil. It didn't trigger the Google passkey thing but didn't load Bitwarden either. So, I downloaded Opera instead, same result.

I'm a, but confused as I thought the passkeys could be shareable so to speak, hence Bitwarden, or device specific, in which case I'd have expected each device I tried to login in to need a password but then I'd be able to create another passkey. Alas, no. 

Not been brave enough to try it yet with an account theat really matters! 

Vitor

You're somewhat at the leading/bleeding edge in using Passkeys with Bitwarden on Android. Only browsers based on Chromium are supported which maybe explains why Opera didn't play nicely. I've found Edge on Android will use Passkeys synced between Bitwarden for Windows and Android. Now available: Passkeys go mobile! | Bitwarden

I've seen posts that the "Autofill" settings in Android Chrome have to be set to "Autofill using another service", in addition to the Android system settings set to Bitwarden.

NB There is a school of thought that says synced Passkeys materially weaken their security, it's preferable to 'lock' keys to a specific device's TPM chip  or use a hardware carrier such as a Yubikey rather than have private Passkeys synced over the internet. 

ChilliBob

Cheers, I wasn't aware it was that new/niche at the moment! Makes a bit more sense, I know when I was almost tinkering with Chrome flags I got the impression it was going a bit homebrew!

I'm still not sold on the concept of passkeys to be honest until I can play with it a bit more. The reliance on a device seems a bit counter intuitive, with multiple devices perhaps it makes sense. The shared nature in Bitwarden also seems a bit odd - useful, but not that different to passwords.

More research required!... Along with YbiKey