1Password Future

> Whatever the case may be, I'm sure it's going to turn out to be something completely worthless to me. You're probably right. Here's their vision of the future: https://www.future.1password.com/ It screams CORPORATE. Not a single mention of family or single user. It's all about business security, safely sharing data, protecting your company, etc.

Sure, but if that key derivation function is protected by a "you get 10 attempts then we wipe the keys" safeguard, the effective entropy is much higher. The question shouldn't really surround the effective entropy of the PIN, but rather the systems in-place to protect bypassing safeguards in the key derivation function which render the actual entropy of the PIN irrelevant. There probably isn't no way around that safeguard, but as more of this gets moved into trusted compute silicon the level of sophistication required to breach it goes up; and is one hardware revision or operating system update away from being made moot again. This thread really smells like https://xkcd.com/538/. Three things you have to remember, that are far more important than any of the concerns you have: 1) The effective entropy of the current system (passwords) is "shrugs shoulders fuck it not our problem". Services can enforce password entropy requirements. They cannot effectually require users to use a unique password. They also cannot forbid users from writing the password they use in a .txt file on their desktop or post-it note or throwing it in Apple Notes (EVERYONE does this outside of our bubble. Apple Notes and Excel are the #1 and #2 password managers on the planet). A six digit pin + hardware TPM key derivation is, at best, the same thing that was guarding how most people store their passwords anyway, and in many cases far better than the current state (if a user's device has no E2EE, or if…

> [1] https://www.future.1password.com/passkeys/ Worth noting is that this is desktop only (and arrives June 6). They are not supporting passkeys on their mobile apps yet, and AFAIK there is no timeline announced for when that will happen.

I think it's because it's a pain to have one key per device. To solve this, you'd need a service like iCloud Keychain (for Apple devices), but that only works for Safari and other Apple stuff. I think once 3rd party apps (like 1Password - see https://www.future.1password.com/) start supporting the syncing of keys, you'll see more use. Alternatively, if you could use iCloud Keychain with Chrome and Firefox, maybe that would work, too. Looking forward to this future!

A lot of comments in this thread are discussing vendor lock-in with Apple or Google. 1Password is working on passkey support already (https://www.future.1password.com/passkeys/) and I imagine others will follow suit. Vendor lock-in isn’t part of the spec, it just happens that in these early days, the OS-level authenticators are the main ones implemented (as are other hardware authenticators). In the mid to long term (e.g. by the time websites start supporting this), I don’t think vendor lock-in will be a problem. It’s no worse currently than chrome or iCloud Keychain being your password manager, which has been part of the landscape for a very long time. Like password managers, there will be other options. The benefit is that unlike passwords, there is a standard API for “autofill credentials” rather than using an extension to update the DOM.

For those wondering: the local threat here is a malicious extension can modify the function of navigator.credentials. While not malicious, this has been shown to be possible by 1Password. See https://www.future.1password.com/passkeys/ and I have confirmed it is possible to modify this function. JavaScript can be monkey patched, in some ways this is great for polyfills. For other cases this can be a threat. If browsers had an explicit mechanism to register extension provided Authenticators and locked down a way to modify the original navigator credentials interface, then we may be able to protect the "first" bytes that come back from the authenticator to the application.

1Password seems to have plans to provide a solution to this problem: https://www.future.1password.com/ > 1Password will remember how you log in to each account so you can get where you're going with a single click

Based on https://www.future.1password.com/ I'm guessing it will be closer to LastPass's auto-login. It still uses the existing username/password form, but autofills and submits for you. So a 1- or 0-click login once you hit the login form, as opposed to the current 3-click system (see login list, click to fill, click to submit). And looks like it also might handle the 2fa portion (which essentially makes it 1fa).

Looks like a large focus will be on corporate users but also on R&D on the next gen side of password management (https://www.future.1password.com/) It doesn't explicitly say enterprise all over that, but I expect it to be that way, only place you can get that sort of return on investment

Seems like a lot of people are missing the piece as to probably why they need the money (and where they're pointing the company in the future). Future of 1Password: https://www.future.1password.com/

Passkeys are open, so you can for example store them in a Yubikey if you want. Else many password managers will soon support passkeys, for example 1Password or NordPass. https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://nordpass.com/passwordless/ https://www.future.1password.com/passkeys/

Indeed I wouldn’t trust Google or Apple to be the only place my passkeys are stored. I’m currently a 1Password user and their upcoming support looks like it could address this issue (I’m not in any way affiliated with them) https://www.future.1password.com/passkeys/

Right, the question is: given that 1Password is adding support for passkeys (https://www.future.1password.com/passkeys/), are they going to support exporting them once they are a passkey provider? I don't see any indication that they are. If they don't plan to support exporting and importing into other ecosystems, then I would argue that their implementation is not portable. I would say that zacharyvoase's concern is still valid in that scenario: > There's no way to migrate your passkeys between ecosystems

1Password does have passkeys in the works. https://www.future.1password.com/passkeys/

For _using_ WebAuthn, Linux without a TPM has the option of using a hardware key like a Yubikey or Nitrokey, or a virtual authenticator like what 1Password proposes here: https://www.future.1password.com/passkeys/ For _syncing_ WebAuthn passkeys, then virtual authenticators that sync over the wire like 1Password above is the only option. Using virtual authenticators means that your key material is in-memory alongside the OS and all running apps. That's why it's so critical that OSs expose pluggable sync fabrics; so that vendors like 1Password, or even YubiCo, can implement sync fabrics that roam through whatever hardware the current platform happens to have available.

> However, I do see some hesitance in the idea of passkeys. Interesting, my impression is that everyone is ready for passwords to die. > I do see some problems with them, namely that it seems like passkeys are locked to the iPhone/Android device and are hard to sync. This will apparently be solved with password managers, which will handle sync across devices/platforms. (One source: https://www.future.1password.com/passkeys/) > What would you need to switch to passkeys? Password manager support with cross-device/platform sync.

I’m really interested in 1Password’s approach to WebAuthN[1]. If they can deliver on their cross-platform promise, other projects will likely be able to do so too. [1] https://www.future.1password.com/passkeys/

1Password already has passkey support in development. They have a demo[0] which works on the latest version of the browser extension. It even syncs with my Macbook and Windows machines though unfortunately doesn't work on Android yet [0] https://www.future.1password.com/passkeys/#demo

Nothing about passkeys needs to be tied to Google. You can use other password managers, and it seems like the major players are all supporting the same standard. For example you can use 1Password: https://www.future.1password.com/passkeys/ If they can do it, other password managers both cloud and local should be able to do this as well.