Replying to Avatar Busch21

Roaming Passkeys like in IOS, Android and i.e. Bitwarden are very convenient.

Devicebound Passkeys like yubikeys are much more secure but you need to onboard multiple onto every service in case you lose one. Replacing them is a lot of work.

I‘m a big fan and happy to answer questions.
Avatar
Big Barry Bitcoin 10mo ago 💬 3

On Linux using Bitwarden, I set up a passkey for Amazon.

1. It only works on the laptop, not on Android. Why?

2. It still requires 2FA, is that necessary?

Reply to this note

Please Login to reply.

Discussion

Avatar
guy 10mo ago

Make sure you passkey provider is set to bitwarden in settings? Also, if using chrome or a variant i had to go into chrome://flags and set the passkey provider to 3rd party.

Avatar
Busch21 10mo ago

1. Also Android 14 and google play services are required. See https://bitwarden.com/blog/bitwarden-passkeys-mobile/ for more Details.

2. the service determines if is requiring additional 2fa after signin with a passkey. PayPal for example requires 2fa despite using a passkey. Most others like Microsoft etc. do not.

Avatar
Big Barry Bitcoin 10mo ago 💬 2

Interesting. I use GrapheneOS without play services so that might be my limiting factor.

Regarding the 2FA, I figured it was an implementation detail, but in your opinion, do you think 2FA is necessary if you're using passkeys?

Avatar
Busch21 10mo ago

Imho. If the key is devicebound and never leaves the device (like yubikeys) it’s sufficient for me. If it is synced with iCloud (apple) or google I would prefer an additional 2FA.

Avatar
Big Barry Bitcoin 10mo ago

Good point. So nothing that the service providers can decide.