FIDO Alliance publishes new spec to let users move passkeys across providers

Original Article ↗ Hacker News Discussion ↗

FIDO Alliance’s new specifications for moving passkeys and other credentials between providers are prompting both optimism and skepticism. Supporters see standardized export/import as a major usability and security win over passwords, especially for non-technical users vulnerable to phishing and weak-password reuse. Critics counter that current passkey ecosystems are still provider-centric, hard to back up or self-host, risk vendor lock‑in and attestation-based gatekeeping, and remain confusing or fragile for edge cases like multi-device power users or disaster recovery.

Lock‑in, control & exportability

  • Many see the new FIDO credential exchange spec as overdue: export/import should have been simple (like CSV for passwords) and available from day one.
  • Strong concern that big platforms (Apple, Google, etc.) intentionally made passkeys non‑exportable to create ecosystem lock‑in; users often cannot move keys out of iCloud/Google.
  • Others argue the new spec is a net positive: it standardizes what were previously proprietary, opaque export/import mechanisms and should reduce lock‑in.
  • Power users want SSH‑style control: raw key files they can copy, back up to paper, or self‑host (KeePassXC, Bitwarden, Vaultwarden). The inability to access private keys directly is viewed as paternalistic.

Security properties & threat models

  • Pro‑passkey side:
    • Passkeys are per‑site keypairs; private keys stay client‑side and aren’t reused elsewhere.
    • They’re resistant to phishing because credentials are bound to domains; browsers won’t use a credential on the wrong site.
    • They reduce password reuse and database breach impact.
  • Critics reply that:
    • If keys can be migrated, they can be stolen; any export mechanism becomes a high‑value phishing/malware target.
    • Relying on cloud providers to sync “device‑bound” keys already weakens the hardware‑bound story.

Backups, recovery & multi‑device usage

  • Big practical worry: losing a phone or account with synced passkeys could mean losing access to hundreds of services.
  • Suggested mitigations: multiple passkeys per account, backup hardware keys, or using a password manager as passkey provider.
  • Many sites only allow a single passkey and UX for adding multiple keys is inconsistent.
  • Some argue that traditional account recovery (email, backup codes) remains unchanged; others note this re‑introduces phishable fallbacks and undermines “passwordless” claims.

Hardware tokens vs software passkeys

  • Hardware tokens (e.g., FIDO keys) are praised for non‑extractable secrets, but criticized as impractical: limited storage for resident keys, easy to lose, and often not supported with multiple registrations.
  • Some want non‑resident keys and CA‑like models to avoid hardware storage limits.

Standards, governance & usability

  • Several complain the spec is complex and driven by large vendors with misaligned incentives (attestation, potential blocking of “too open” providers).
  • Others emphasize that designing something secure and usable “for billions” is intrinsically hard; passkeys already greatly help average users who are routinely phished via SMS/OTP.
  • Broad agreement that tooling, browser support, and UX (especially for non‑technical users) are still immature and uneven.