Best practice to use Bitwarden as passkey provider

[Nail1684]

@cmbarton

One more success. I deleted the passkey for GitHub in the Apple passwords.app. Then I deleted it in GitHub. This allowed me to add a new passkey, which did finally bring up the BW save a passkey window.

That’s great to hear! And at the same time, that’s not as it should be. (more to that in a minute)

@cmbarton

So for GitHub, at least, in spite of what the web site implies, you can’t add a passkey for BW if you already have a passkey for another app.

At least, that seems to be true for you / your system at the moment.

I just tried it myself.

• Starting point: A few minutes ago, I just had one GitHub-passkey in Bitwarden and one on my Android phone.
• Then, I could add a third GitHub-passkey for Windows 11 Hello without any problem.
• I could login now with both passkeys (tried it… didn’t try it with the phone, but it shouldn’t be affected).
• Then I deleted the Bitwarden-passkey on both sides (in GitHub and in my Bitwarden vault). Without a problem, I could add the Bitwarden-passkey again to the other two passkeys (Android phone and Windows Hello).

So it’s not a general limitation of the GitHub site. I very much suspect, that the Apple passwords.app blocks it for you somehow, as soon as it has a passkey for a given site. Or maybe if it is active at all in some cases… And that may be the case here:

@cmbarton

This leaves the NSF site, which I tried again today. I have only 1 login entry for it, my ID and PW are correct. I have 2 URLs (depends on how one logs in), but all are in the same BW vault entry. I still don’t get the add a passkey window. I did have a passkey set in passwords.app but I deleted it.

… I just deleted the Bitwarden/GitHub-passkey pair again and deleted the GitHub URL in my GitHub login item in Bitwarden. If I add the passkey, the popup still opens up (but now I have to search for the GitHub entry):

(I redacted the item - but it was not the GitHub login item…)

I could then add the passkey to the GitHub login item (after the search). And after that, I added the URL again to the login item.

So, kind of a repetition, but If you don’t even see the “save passkey?” window again, that is not influenced by any data in the login entry (via the search field, I could store the GitHub-passkey in any login item… “wrong” URIs, “wrong” email/password… doesn’t matter).

As written before, I think Apple/MacOS or their password.app blocks the popup somehow on your system. (given, your NSF-URLs are still not on the “excluded domains” list…)

PS:

[Nail1684]

PS:

@cmbarton

This leaves the NSF site, which I tried again today. I have only 1 login entry for it, my ID and PW are correct. I have 2 URLs (depends on how one logs in), but all are in the same BW vault entry. I still don’t get the add a passkey window. I did have a passkey set in passwords.app but I deleted it.

Did you only delete the NSF-passkey in the passwords.app? Or did you delete the whole NSF-entry in the passwords.app?

[cmbarton (Michael Barton)]

I deleted the passkey, which is stored separately from the ID/PW item. But I turned passwords.app off for autofill and everything else (but did not delete it, of course).

[cmbarton (Michael Barton)]

For GitHub, I had to delete the passkey in GitHub itself before I could begin to add new ones from BitWarden. I’ve written to IT at NSF to see if they can delete any passkey stored in my account. I am unable to do that because, while I can log into my account with other 2 factor authentication, I cannot get to my security settings without the passkey that I do not have.

[adding this in a separate reply because I could not edit my previous post after a mere 30 min, rather than 24 hrs]

[cmbarton (Michael Barton)]

Here is an update. As noted, 2 days ago I deleted my Apple passkey for NSF, but still could not get the window to create a new passkey in BitWarden. NSF IT checked and told me that there was no passkey saved in their system for my account. So I tried it again this morning without much hope.

And it worked. It went very smoothly and I was able to create a passkey assigned to my NSF login entry. Perhaps it took several days for my deleting the Apple passwords.app passkey to filter through their system. I don’t know.

I think the final take-home message on this is, if you have a passkey saved in Apple’s passwords.app it may block the creation of a passkey in BitWarden. But just deleting the passkey entry in Apple passwords.app may not solve the problem.

• In the case of GitHub, I had to remove the entry for the apple passkey in my BitWarden account.
• For NSF, it took several days for the deletion of the Apple passkey to register.

But after those additional steps or time lags, creation of a passkey in BitWarden went smoothly.

A further test would be to create a new passkey in the Apple passwords.app and see if that blocks usage of the passkeys I created in BitWarden. But after all the difficulties I went though to get passkeys to work, I will probably leave that to someone else

[Nail1684]

@cmbarton

But I turned passwords.app off for autofill and everything else (but did not delete it, of course).

BTW, that passwords.app is the MacOS/iOS iCloud KeyChain in the end? I’m really not familiar with Apple…

[Nail1684]

@cmbarton

Here is an update.

Thanks for the update!

@cmbarton

And it worked.

… finally (with the last one of the three test-passkeys)!

@cmbarton

I think the final take-home message on this is, if you have a passkey saved in Apple’s passwords.app it may block the creation of a passkey in BitWarden. But just deleting the passkey entry in Apple passwords.app may not solve the problem.

That’s interesting to know for sure. Nevertheless “weird”, that it took “several days” in some cases, as you described…

@cmbarton

… But after all the difficulties I went though to get passkeys to work, I will probably leave that to someone else

Yeah, what a bumpy road that was… Thank you for your persistence. I’m glad you found the way to make it work on your system.

[richard.wonka]

A quick note of appreciation also from here. I had had that same problem, but not the spoons to pursue it.
Been reading along and can report success, also.
Much appreciated, thank you!

[cmbarton (Michael Barton)]

passwords.app has replaced keychain access.app for most stuff, especially for connecting to things outside my computer itself. When I deleted the passkey for NSF, it deleted the entire NSF entry, including loginID, PW, and passkey.