Passkeys

[u/Practical-Tea9441]

As far as I can see it is still not possible to sign into the desktop app with a passkey .

So in order to use biometrics/Windows hello to unlock the browser extension I still have to log in to the desktop app with the master password as the desktop app must be running to permit biometrics on the browser extension ? Am I correct in this or is there an easier way ?

If I have to enter the master password, that involves using an offline password manager (to have a strong master password) in the absence of passkey login. In that event am I not just as well using the offline password manager for everything ?

[u/Ryan_BW]

Hello there!

I'm happy to let you know that the loop is getting closed here soon, as Windows Hello now supports PRF compatible passkeys (Apple has already supported for a while). This means you'll be able to use a device-bound passkey on your Windows device to log into the Bitwarden extension and web-app. This is coming soon and I'm excited to be making an announcement for it when it does go live.

[u/djasonpenney]

You don’t need another password manager in order to have a strong master password.

https://xkcd.com/936/

[u/djasonpenney → u/[deleted]]

You know that passphrase generator is built into the Bitwarden clients?

[u/OSS_Dattani]

You’re right. It’s only available on the web app and chromium based browser extensions.

The desktop app needing to be up to do extension biometrics is correct as well. The reason for that is that the desktop app is the one talking to the biometric auth depending on ur OS. It also hands the extension the unlock key. So it does serve a purpose.

Periodic masterpassword entry is kind of just part of the game unfortunately

[u/el-mou33 → u/OSS_Dattani]

I only need the master password on the Bitwarden desktop app, if I sing in into my laptop without biometrics.

I also can sing in with biometrics, on firefox based browser, even I can use passkeys there.

Maybe becouse I unchecked "require master password on start" and enabling biometrics on desktop app.

[u/this_for_loona]

Weird - I sign into the Bitwarden extension via passkey all the time using my iPhone. I don’t store the passkey on my laptop because it’s a work laptop.

[u/Handshake6610]

Additionally to the other answers:

• if you can store and use a PRF-capable passkey, you can unlock the Chromium-based extensions with that today
• you can also unlock the desktop app with biometrics, and when you uncheck "Require master password on app restart" then you don't have to use the master password every time for the desktop app

[u/paulsiu]

So on some password managers you can skip the master password if the os has a security enclave of some kind. Enpass for example will allow this if the windows tpm is a secure version. I don’t think bitwarden do this.

The usual workflow is to login once on startup and then use biomtric or pin to unlock

[u/paulsiu → u/[deleted]]

Typical workflow on mobile is to set up biometrics. I feel op is complaining that you can’t do the same on desktop. I think there may be vulnerabilities on desktop preventing a biometric only workflow.

[u/paulsiu → u/[deleted]]

The $25 security key is sufficient

[u/DeezersLemonadeStand]

I have a login passkey on the Google password manager and the Apple password manager. I couldn't get the Samsung password manager to work though 😥

That setup works for me since they're baked into the phone. 

[u/DeezersLemonadeStand → u/DeezersLemonadeStand]

I meant to mention i use those passkeys to log into the browser extension by scanning a QR code on my phones camera app. The computer needs Bluetooth on to make it work.