FIDO Alliance publishes new spec to let users move passkeys across providers

There shouldn't be. Secure enclaves aren't secure if they can be copied

How does this suddenly become a problem when as the user I want access to my keys, but it isn't a problem when corporations copy my keys between them, which is what this post is about?

Secured against who?

So you are against this new spec becoming a standard then?

The exchange spec suggests that the sending secure enclave sends encrypted credentials to the receiving secure enclave; they're never unwrapped in public between 'trusting' enclaves; which enclaves will trust each other enough to perform the credential transfer is another question.

In that case, the keys would be a non-starter. The overwhelming majority of tech requests relate to people forgetting their passwords and getting in trouble because the browser's password manager forgot the password itself.

The reality is that the biggest pushers of Passkeys are the providers with the least amount of infrastructure stability. If you want people to get to use Passkeys, providing an exit tool from Google and Apple is a must, because both providers are godawful at not accidentally mushing up your data. That's not so important if all you're using their infrastructure for is a periodic backup/use it to transfer photos to your PC, but it's a problem for anything that has to be stored long-term.

Passkeys and secure enclaves are only loosely related. You can implement one using the other, but it’s by no means a requirement.

And even when they are, nothing says that secure enclaves can’t have importable or exportable keys. Many schemes do both on a regular basis.

Any exit tool just becomes the latest focus of phishers and credential stealing malware.