Biometric authentication without full desktop app

[jeffmpitman (JBIT)]

Thanks to both of you for taking the time to answer my questions.

Best Regards

[DonEstefan]

Passkeys where invented for web authentication. They support biometry and are available natively in the browser sandbox.
So, technically, it should be possible to use passkeys for biometric unlock of the browser extension without the need for a separate desktop app. At least when you are using Win11 and store the passkey to unlock bitwarden outside of bitwarden (like in Windows’ built in passkey store).
Check out “Heylogin” password manager to see a proof of this concept. Their browser extension is basically a modified version of their web app, which makes it possible to unlock the browser extension using passkey biometry. They don’t even have a desktop app. Their mobile app is only needed for initial setup of the browser extension. Afterwards you can choose to unlock the browser extension with only passkey biometry (among others).

[grb]

@DonEstefan

So, technically, it should be possible to use passkeys for biometric unlock of the browser extension without the need for a separate desktop app.

There is a separate feature request, here:

Unlock Bitwarden with 2FA, e.g. security key / YubiKey (instead of, not in addition to password)

@tgreer closed the 2FA when ‘unlocking’ feature request due to the new “force 2FA upon timeout”. While that is a great feature it is not what the majority of the people in that thread meant. Lastpass has this great browser extension feature that allows a user to unlock with their Yubikey, without typing a password. This is fast and far more secure than typing a password. This feature request is to allow a flow where: User has a logged in browser extension Browser extension locks after x min…

[DenBesten]

@DonEstefan

So, technically, it should be possible to use passkeys for biometric unlock of the browser extension without the need for a separate desktop app.

Login-with-Passkey already works with the web vault if the web browser supports an optional passkey feature called PRF. Rumor has it that this same functionality is coming to the other vaults (desktop, browser, mobile), but it has not yet hit the roadmap.

That said, Login-with-Passkey is not this FR. The proposal here is a lightweight desktop app that performs just the authentication function. Supporting login with passkeys is the subject of another feature request.