Make Login Passkeys Identifiably Distinct from 2FA Passkeys on End Device

[Nail1684]

@Micah_Edelblut

Note that they state that only discoverable credentials can properly be referred to as Passkeys. Bitwarden doesn’t share this view.

Not only Yubico sees it that way. The WebAuthn specs (and the FIDO Alliance) also share this view (and they are the ones, defining the standards here…).

Only discoverable credentials get called “passkeys” in the current W3C working draft Level 3:

Non-discoverable credentials on the other hand don’t get associated with the term “passkey” at all:

And from passkeys.dev (site from W3C and the FIDO Alliance):

(–> passkeys.dev - Terms)

I’m still not sure, why Bitwarden decided to not use the official definition of “passkeys” as a discoverable credential.

[PS: By that I’m not criticizing any technical features, but only that the “labels” aren’t used as the standards define them…]

Anyway…

@Micah_Edelblut

As to the feature request, Bitwarden could differentiate between a discoverable credential (used for login) and non-discoverable ones (used for 2FA). We also have feature enhancements we are contemplating that would allow users more control over what their passkeys can be used for (2FA, login, unlock). This could alleviate the issue with an authenticator overwriting your login passkey when registering a 2FA passkey, or vice versa.

Those would be some improvements!