FIDO Alliance publishes new spec to let users move passkeys across providers

I'm super curious how this will ultimately work. As noted in another thread, secure enclaves aren't secure if they can be copied. Such that, if this is moving the passkey by copying it, I'm not at all clear on how that stays secure?

Generally this spec is talking about the kind of passkeys that are stored in password managers, not the kinds used by hardware security keys. Those in a password manager have always been technically copyable somehow, there just wasn't a standard format or protocol for doing so.

I knew that "passkey" had grown to refer to a set of different things. I can't say this upsets me, as it does sound like progress over the old status quo. Still, is confusing for those of us that bought in at the beginning.

The terminology is definitely a mess, but I believe at least “passkey” has never referred to hardware authenticators. Those were usually called “security keys” or similar.

The Yubico FAQ explains some of the history fairly well: https://www.yubico.com/blog/a-yubico-faq-about-passkeys/

In particular, they distinguish between "copyable" and "hardware-bound" passkeys. They're both passkeys, and can be used wherever passkeys are supported, but only the "hardware-bound" passkeys support attestation.

Passkeys don't need to be hardware bound.

The (probably?) most widespread implementation of them (iOS + macOS et. al) isn't; they're synced between devices.

Passkeys aren’t identical with secure enclaves.

They can be stored in them, but also in software; even when stored in hardware, they can be marked as extractable to some trusted party (a companion device with the same root of trust, a trusted cloud sync service, a supply chain attacker etc.)

Agree. Passkey should be reserved for credentials that can be synced or exported to different providers, as this is what is most analogous to a password from a user perspective.

There should be a different standardized term used for hardware bound keys. So users wont get confused.

Fair, but if the secret is exportable, then it loses a ton of its power.

If you are worried about state level activity, have it stored in a single place that can be compelled by law to disclose it and that is off the table for you.

Which, sure, you can argue that there are still hardware tokens for people. But that is itself a signal, no?

Hardware-bound passkeys have always been copyable by the proprietary vendor.

Make a passkey on your Mac, it appears on your iPhone.

Make a passkey on your Android, it appears on your other Androids.

Anyone who can bind a new iPhone or Android to your Apple/Google account wins your passkeys. I think the only passkeys properly tied to hardware are dedicated FIDO devices.