Here in Switzerland, the national postal service (Suisse Post) uses a digital identity platform called SwissID, which is now replacing all their 2FA methods with Passkeys - a welcome move. However, I wasn’t able to register their Passkeys on either iOS or macOS using Bitwarden, so I contacted their support team to check why it wouldn’t work with Bitwarden.
Here’s a rough translation of the response I received in German:
"Unfortunately, this passkey provider is not compatible with our service.
Try it e.g. with Google/Apple/Microsoft etc.
We will work more and more with PassKeys in the future.
This means that we will continue to select very carefully in the future, but cannot yet select all the desired providers".
I was under the impression that Passkeys were designed to be service-agnostic, so users wouldn’t be locked into Google, Apple, Microsoft, and similar platforms.
Is there any way to work around this limitation on Bitwarden’s side?
Well, the relying party can restrict the authenticators they allow for passkey creation/storage/usage, I guess (via the AAGUID).
The people from SwissID seem to restrict their passkeys to “FIDO2-compliant passkeys” (which is probably a bit funny (or sad), as every passkey is FIDO2 technology):
But I think, here (and actually, at the end of the first screenshot also) they actually say what they mean: the passkeys (?!) should be certified (by the FIDO Alliance):
Perhaps it has something to do with password managers like Bitwarden incorrectly setting the UV flag to 1 even thought they do not actually perform user verification when the RP requests it…
It’s most unfortunate that services can implement it this way. It’s frankly very discouraging as a consumer.
It’s also interesting that they are pushing users, like myself, to lose 2FA - unless using one of the aforementioned services - rather than allowing users to utilize a Passkey manager of their own choice. Seems like a shaky policy at best.
An addition to that: using the SwissID app seems to be one of four 2FA methods there (so it seems, they are not replacing all 2FA methods with passkeys):
Why they don’t implement passkeys (or so-called non-discoverable FIDO2 credentials / often called “security key”) also as a separate 2FA method, I don’t know…
And I also don’t understand, why they (obviously) regard login with password and e.g. SMS-2FA as more secure than using a non-FIDO2-certified passkey manager…
But as written before - the sites can implement passkeys as they want to.
I stand corrected - according to an email sent out recently - they are replacing their app 2FA with Passkeys. Leaving that and text messages as the remaining options.
Which, indeed, begs the question how they can view that as more secure that using Passkeys over Bitwarden..
The whole thing seems kind of pointless - especially with this easy bypass..
In any case, I’ve been using it on my two accounts (you need one account for each address you have registered with the post ) for more than a day. Let’s see if it fails later on. I’ll update the post then.
) for more than a day. Let’s see if it fails later on. I’ll update the post then.