Before switching to Apple Passwords, I think it’s worth pointing out that the only web browsers that can access Apple Passwords passkeys are those that Apple allows.
Would you rather arbitrary programs access your passkeys?
Yes. Definitely. Ideally by providing my OS password on first access, more or less how it works for passwords when an application wants to access the macOS keychain.
I see no need for Apple to insert itself here and to arbitrarily limit who is allowed to make a full-featured browser and who isn’t.
The criteria seem reasonable, but I understand the concern. I believe that the passkey threat model assumes the browser is trustworthy - eg the indication of which domain (RP_ID) is requesting authentication is critical to the phishing resistance, and comes entirely from the browser. So there is some justification for vetting that an app is actually a browser before letting it request authentication.
I've been using KeePassXC for years and that's been great. It's synched to my devices via Syncthing (so it stays P2P) and thus it never goes to any cloud. I could probably set up Vaultwarden on my homelab server, but the ease that KeePassXC offers doesn't really make me want to switch away from it.
I badly want to switch to "Apple Passwords Exclusively + readonly encrypted blob export", but this is a deal breaker:
The Passwords app unlocks using ... your device passcode. You cannot set a different “master” password.
I am happy to hide 95% of my credentials behind a short, easy to type on the on-screen keyboard mobile passcode. But I want more entropy for the master password guiding the remaining 5%, which means I have to using something different TT
Interesting that Apple Passwords requires an application outside of your browser to work. Specifically, the iCloud Passwords browser extension depends on iCloud for Windows if you're not on MacOS. That means you can't access your passwords unless you can install software on the client, which means you can't get your personal credentials on an enterprise-managed work device.
True, but it seems the same for any alternatives? It's not like you can (or should) install your personal 1p setup onto a locked-down, presumably spyware laden work device, either.
The method outlined in this post worked perfectly for me migrating from 1Password to Bitwarden. In fact, it worked better than using the 1Password export to Bitwarden's importer, with respect to a couple SSH keys.
It surprises me how few technical people use pass/gopass. It's a git repository with encrypted secrets inside. Do you trust GPG or age encryption? If so, maybe consider it.
I prefer gopass for its speed and age encryption. And use pass for ios on ios devices. Granted, I use my own build of pass for ios to encrypt/decrypt age secrets on mobile devices.
With two years of support for the feature request measured in a handful of people putting in the effort to mash a thumb up button, I know I'm not at risk of inundation.
This arrangement communicates to people that I've built this for myself, and I'll add features as needed. Anyone is welcome to take the code and release it as their own if they like, or take the testflight build for a test drive.
I've added more features in my private repo and will continue doing so.
I like the NitroKey. I know a lot of people like the YubiKey.
Generate your PGP key on a computer you trust. Store a copy on a USB stick in a safe location. Transfer another copy to e.g. a NitroKey. Delete copy from computer. Voila!
My first NitroKey lasted 8 years of being in a sweaty pocket with house keys all day, and hours of use each day, before it became unreliable. If that's representative, I think people can survive doing the above dance about once per decade! (To guard against any downtime whatsoever – even once a decade – I keep a spare NitroKey fully set up and ready as a standby in the safe that holds the plaintext secret backup.)
As a bonus, the latest NitroKeys and YubiKeys also do FIDO so you can reduce reliance on passwords where possible.
PS: I agree that the GnuPG user experience leaves something to be desired. But you only really have to interact with its pain points once a decade with the above process. And I have high hopes that Sequoia will remedy a lot of its faults.
The relative absence of git users unable to manage their ssh keys suggests it isn't a large problem for technical people. GPG can be a bit more of a chore, which is why I use age.
I generally don't move them and have a key per device; secrets get encrypted for every public key. So public keys get shared when new devices are given access, and private keys never leave devices.
It wasn’t a huge problem until recently, but the fact that most people have their private keys sitting unencrypted in ~/.ssh makes them a juicy target for attackers who plant malware in dev devices. I much prefer letting 1Password manage my keys, and even better, using biometrics instead of a password to unlock them.
meta: This post is clearly riding the 1Password Omarchy support fall out. Given the amount of negative press, I wonder if there was tangible financial impact for AgileBits Inc or not.
matthiasportzel | 17 hours ago
Before switching to Apple Passwords, I think it’s worth pointing out that the only web browsers that can access Apple Passwords passkeys are those that Apple allows.
https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.developer.web-browser.public-key-credential
I guess it’s always good that you can export everything to a different password manager.
raylai | 8 hours ago
Which include Chrome, Safari, Firefox.
What browser are you using that cannot access Apple Passwords passkeys?
Would you rather arbitrary programs access your passkeys?
pilif | 6 hours ago
Yes. Definitely. Ideally by providing my OS password on first access, more or less how it works for passwords when an application wants to access the macOS keychain.
I see no need for Apple to insert itself here and to arbitrarily limit who is allowed to make a full-featured browser and who isn’t.
oceanhaiyang | 8 hours ago
Isn't that the case will all apple services? I don't understand why the author doesn't use a more device agnostic service such as Vaultwarden.
willhbr | 8 hours ago
From the original post:
I think they may have some reasons to use the Apple Passwords app.
oceanhaiyang | an hour ago
You might be right.
neilmadden | 16 minutes ago
The criteria seem reasonable, but I understand the concern. I believe that the passkey threat model assumes the browser is trustworthy - eg the indication of which domain (RP_ID) is requesting authentication is critical to the phishing resistance, and comes entirely from the browser. So there is some justification for vetting that an app is actually a browser before letting it request authentication.
ettolrach | 14 hours ago
I've been using KeePassXC for years and that's been great. It's synched to my devices via Syncthing (so it stays P2P) and thus it never goes to any cloud. I could probably set up Vaultwarden on my homelab server, but the ease that KeePassXC offers doesn't really make me want to switch away from it.
haroldp | 13 hours ago
Same. KeePassXC, sync-ed with NextCloud. Pretty happy with it.
benoliver999 | 13 hours ago
On android I have been using Keepassdx and the interop with PC is great. Quite good UX on mobile these days
evert | 9 hours ago
Been using it for years too. Awful UX but I like the sync model and that's keeping me there for now.
matklad | 16 hours ago
I badly want to switch to "Apple Passwords Exclusively + readonly encrypted blob export", but this is a deal breaker:
I am happy to hide 95% of my credentials behind a short, easy to type on the on-screen keyboard mobile passcode. But I want more entropy for the master password guiding the remaining 5%, which means I have to using something different TT
pbronez | 17 hours ago
Interesting that Apple Passwords requires an application outside of your browser to work. Specifically, the iCloud Passwords browser extension depends on iCloud for Windows if you're not on MacOS. That means you can't access your passwords unless you can install software on the client, which means you can't get your personal credentials on an enterprise-managed work device.
lilac | 14 hours ago
I imagine this would also immediately discount all linux desktops/laptops
Sophistifunk | 9 hours ago
True, but it seems the same for any alternatives? It's not like you can (or should) install your personal 1p setup onto a locked-down, presumably spyware laden work device, either.
dkl | 17 hours ago
The method outlined in this post worked perfectly for me migrating from 1Password to Bitwarden. In fact, it worked better than using the 1Password export to Bitwarden's importer, with respect to a couple SSH keys.
hjr3 | 17 hours ago
I wrote some notes on my experience migrating from 1Password to Apple Passwords here: https://bsky.app/profile/hermanradtke.com/post/3murtzghpfk2w
ni5arga | 13 hours ago
I have personally found the Apple Passwords chrome extension to be very buggy.
erock | 11 hours ago
Switched from pass to pa which is a wrapper around age. Love it so far!
https://github.com/biox/pa
adriano | 12 hours ago
It surprises me how few technical people use pass/gopass. It's a git repository with encrypted secrets inside. Do you trust GPG or age encryption? If so, maybe consider it.
I prefer gopass for its speed and age encryption. And use pass for ios on ios devices. Granted, I use my own build of pass for ios to encrypt/decrypt age secrets on mobile devices.
erock | 11 hours ago
Hey I need that age patch, I switched from pass to age and now just ssh into my dev box to copy passwords
adriano | 10 hours ago
Shoot me an email, happy to help!
mdaniel | 6 hours ago
Unless you have licensing concerns, posting it as a gist/pastebin/ghostpaste/whatever would be better than having 20,000 people email you
adriano | 6 hours ago
With two years of support for the feature request measured in a handful of people putting in the effort to mash a thumb up button, I know I'm not at risk of inundation.
This arrangement communicates to people that I've built this for myself, and I'll add features as needed. Anyone is welcome to take the code and release it as their own if they like, or take the testflight build for a test drive.
I've added more features in my private repo and will continue doing so.
Halkcyon | 11 hours ago
The problem is key management then.
gspr | an hour ago
I like the NitroKey. I know a lot of people like the YubiKey.
Generate your PGP key on a computer you trust. Store a copy on a USB stick in a safe location. Transfer another copy to e.g. a NitroKey. Delete copy from computer. Voila!
My first NitroKey lasted 8 years of being in a sweaty pocket with house keys all day, and hours of use each day, before it became unreliable. If that's representative, I think people can survive doing the above dance about once per decade! (To guard against any downtime whatsoever – even once a decade – I keep a spare NitroKey fully set up and ready as a standby in the safe that holds the plaintext secret backup.)
As a bonus, the latest NitroKeys and YubiKeys also do FIDO so you can reduce reliance on passwords where possible.
PS: I agree that the GnuPG user experience leaves something to be desired. But you only really have to interact with its pain points once a decade with the above process. And I have high hopes that Sequoia will remedy a lot of its faults.
adriano | 11 hours ago
The relative absence of git users unable to manage their ssh keys suggests it isn't a large problem for technical people. GPG can be a bit more of a chore, which is why I use age.
Halkcyon | 11 hours ago
Idk how often you move keys around. I often just make new keys and add those to my account instead.
adriano | 11 hours ago
I generally don't move them and have a key per device; secrets get encrypted for every public key. So public keys get shared when new devices are given access, and private keys never leave devices.
Halkcyon | 11 hours ago
I see. Maybe I have a misunderstanding about how gpg works then.
erock | 10 hours ago
This is my strategy with age. I just have a script that I run to rekey when I add a new device.
https://erock-git-dotfiles.pgs.sh/tree/main/item/bin/pa-rekey.html
yawaramin | 5 hours ago
It wasn’t a huge problem until recently, but the fact that most people have their private keys sitting unencrypted in
~/.sshmakes them a juicy target for attackers who plant malware in dev devices. I much prefer letting 1Password manage my keys, and even better, using biometrics instead of a password to unlock them.atmosx | 2 hours ago
meta: This post is clearly riding the 1Password Omarchy support fall out. Given the amount of negative press, I wonder if there was tangible financial impact for AgileBits Inc or not.