tennysont

Largely false. The Pixel verifies the OS and will reveal `verifiedBootState != Verified` on GrapheneOS in the attested passkey at registration, which websites may choose to reject. Apple Silicon has an undocumented SEP which prevents Asahi Linux from accessing it. There may be other examples now or in the future.

Also, I think you can deduce the device color from [1] on Android.

No, there is a working draft of a protocol. The "format" is only for use in the protocol, not a separate thing. Thus, giving the user a file is disallowed under the spec as per §5.1.1.1 which reads

  > Explicitly state that the orchestrating party only transmits the credential exchange data between the exporting provider and importing provider.

Furthermore, 1Password (who is apparently leading the way on the FIDO exchange protocol design) has not implemented _any_ passkey export on _any_ desktop platform.

It is interesting that you listed Bitwarden, since I believe that FIDO developers have specifically disavowed Bitwarden's behavior of allowing users to access their passkeys.

  > keepassxc: no
  > FIDO devs: but the spec
  > keepassxc: that part of the spec is anti-user
  > FIDO devs: do it or we might blacklist your app
  > keepassxc: can't we just impersonate another password manager? also isn't bitwarden already doing this?
  > FIDO devs: "Someone else is doing bad things too" isn't the greatest argument...
  > FIDO devs: maybe we could hop on a phone call?

Though, I do find it amusing that I commented about 1password's inability to communicate their security model, and your reply links a reddit post[1] in which everyone is disagreeing over whether or not iCloud secret key syncing actually occurs.

  You can only export passkeys in 1Password for iOS and Android at this time.

  Your data is yours. If you want to export your data from 1Password for any reason, you can.

And for the record, this is not impossible. Bitwarden does it[3] via the magic of "ignoring the part of the specification that says not to give users their data." Any open source software would do the same. This is why 1Password is no longer the "good guys" despite having rationalizations for their actions.

It immediately creates a huge lock-in in a hard-to-notice way. Luckily, I did noticed early on and manually removed the 20 or so passkeys I had created.

Earlier this year, I lost my iPhone and restored from backup. I was shocked to see that I could log into my 1Password account using only the master-key, and that the secret-key was not required. 1Password clearly stated that the secret-key was required to setup a new device, but it turns out that they also (perhaps recently) configure it to upload to all devices in your iCloud account[1]. Ever since then, I've lost faith in 1Password's ability to communicate their security model to me and started looking for an off-ramp.