APIs for third parties to create and manage passkeys?

[MaKleSoft]

Sorry if this has been asked before, or if this is not the best place to ask, but I can't for the live of me find any information on this on the net and, quite frankly, @MasterKale is by far the most knowledgeable person I know on the topic so...

Are there currently any public apis for password managers or other apps to create and manage passkeys on the users behalf? I know that a few password managers already claim to support passkeys, but it seems impossible to find any information on this online. It seems to me that this would require some way of registering with the browser or device vendor, possibly as part of some browser extension? If anybody could shed some light on this, that would be awesome. Thanks!

[MasterKale]

Hey @MaKleSoft, you're probably thinking about the "passkey provider API's" that operating systems are offering third-party apps so that they can manage passkey lifecycles for users.

Here's the short list of APIs by OS:

• Android: https://developer.android.com/jetpack/androidx/releases/credentials
• iOS/macOS/iPadOS: https://developer.apple.com/documentation/authenticationservices/ascredentialproviderviewcontroller
• Windows: TBD

[MaKleSoft]

Thanks for the info! What is confusing to me is that these are all native APIs whereas 1Password seems to be able to support pass keys from the browser extension without any native components (tested without having the native app installed). Is it possible that there is some undocumented web extension api?

[MasterKale]

Is it possible that there is some undocumented web extension api?

No, the simple truth is that providers like 1Password are simply intercepting WebAuthn API calls (e.g. navigator.credentials.get()) and handling the ceremony without the native browser support ever getting invoked. It's pretty much the only technique available to such providers for lack of a native app that can implement the passkey provider OS APIs.

[MaKleSoft]

So they're basically overwriting the api using content scripts? That sounds like a terrible idea... Doesn't that break native webauthn support?

[MaKleSoft]

I'd be very interested to hear a pentesters opinion on this. Sounds like an exploit waiting to happen.

[spendres]

This will confuse people to no end. Lastpass, 1Password… will have to rebrand to Biopass and >1Passkey.

…

On Tue, Sep 12, 2023 at 8:46 AM Matthew Miller ***@***.***> wrote: Is it possible that there is some undocumented web extension api? No, the simple truth is that providers like 1Password are simply intercepting WebAuthn API calls (e.g. navigator.credentials.get()) and handling the ceremony without the native browser support ever getting invoked. It's pretty much the only technique available to such providers for lack of a native app that can implement the passkey provider OS APIs. — Reply to this email directly, view it on GitHub <#426 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEVLYEZEXIIMUUEV5ZSADDX2BKTLANCNFSM6AAAAAA3VFAIAI> . You are receiving this because you are subscribed to this thread.Message ID: <MasterKale/SimpleWebAuthn/repo-discussions/426/comments/6978571@ github.com>

[MaKleSoft]

Yep. The entire rollout process and communication around passkeys has been a disaster so far IMO. It feels like passkeys are being pushed by a small number of interested parties who seem to be more interested in using the technology as a marketing hook than actually providing a feasible (and actually superior!) replacement for passwords...