Post #2595471

@jtb@toot.wales : yes, but AFAIK passkey private keys cannot be exported from "Apple Passwords" and neither from "Google Passwords". Which are probably used most. Why would people install a third party password manager (often payed, and/or a privacy/security risk - remember Lastpass) if your phone comes with such an app and they're unaware of the risks? Edited to add: my Feb. 2024 write up on Full Disclosure still mostly applies. Screenshots, chronological: 1) Top right: contents of Google Password Manager after creating a passkey on https://webauthn.io 2) Left: tapping the "Delete data" button in https://chrome.google.com/sync 3) Bottom right: contents of Google Password Manager after tapping the "Delete data" button in https://chrome.google.com/sync. The passkey is gone. People are wrongly made to believe that Google passkeys are stored safely on their device; they are not. @rmondello@hachyderm.io @brandonbutler@mastodon.social #AndroidPasskeysGone #Passkeys #AccountLockout