Ditch the master password in favor of passkeys

Feature Requests Password Manager
, ,
1

Hi there,

I‘d love to see Bitwarden implementing a similar feature to that what 1Password announced two days ago: The ability to completely ditch the master password in favor using passkeys. (Technically speaking, all FIDO2 capable usb keys and smart cards should be able to comply with that, but more on that later.)

Technical details:
It‘s actually very simple, straightforward and fast to implement. The current account encryption key will be encrypted with the public key of the passkey. This process must be repeated if you want to add some backup Yubikeys for example. After authentification, the encrypted payload (aka the account encryption key) will be decrypted by the private key of the respective passkey.

Please note that this feature should be optional.

If you have any questions or comments, feel free to ask. I‘m open to other opinions and thoughts.

Have a great day!

(Message to the mods: This feature request is NOT the same as the „unlock database with yubikey…“ request, so please don‘t merge them.)

3 Likes
2

Are you certain that a FIDO2 capable USB key is able to do that decryption?

3

@tomtom Is the following Feature Request asking for the same thing as you? If so, we can merge your request into that one.

4

Bitwarden recently acquired passwordless.dev so they appear committed to this area. I hope passwordless sign in is introduced by Bitwarden this year as they have passkey support on their development map. I have added a vote to the other feature request as they appear very similar.

2 Likes
5

What would the future of a bitwarden vault look like if mankind transitions to these passkeys/passwordless system? Would each sites’ key still be able to be saved in each vault item?

1 Like
6

It‘s actually very simple, straightforward and fast to implement. The current account encryption key will be encrypted with the public key of the passkey. This process must be repeated if you want to add some backup Yubikeys for example. After authentification, the encrypted payload (aka the account encryption key) will be decrypted by the private key of the respective passkey.

As @DoctorB suggested, the passkey (Fido2/WebauthN) api doesn’t really allow this. It allows for signing challenges, but you can’t encrypt/decrypt data directly. So while it could be used in the pre-auth, to replace the master-password-hash being sent over the network, you would still have to enter your password to decrypt the encrypted vault.

There are some other extensions, some of which are not developed / merged yet, which would make something similar to this possible. For example: https://github.com/w3c/webauthn/pull/1424

7 Likes
7

Yes, I am

(I asked 1P support)

8

No and you should remove this request because it’s outdated and already implemented because of changing standards

9

1Password thinks they can do that. Although I‘ve no idea how they’re going to implement it

10

Did 1P support say which protocol they are using?
WebAuthn is not a general purpose encryption API.

I couldn’t be sure but I was expecting you to say your design was to use the hmac_secret extension in the CTAP2 protocol which does allow for a symmetric secret to be scoped to a credential, and seems to be supported in the latest versions of the main browsers.

But you probably had a better idea.

1 Like
11

OK, I won’t merge the threads. However, I’ll let @bw-admin decide whether to close and/or archive the other thread.

1 Like
12

Just a question as to why you would thing the other request should be closed, or this one not merged into the other.
As I understand standards are in the works but still nothing solid as of yet, Bitwarden being a member of the FIDO Alliance is highly committed to working with industry partners and closing watching any upcoming changes and stadardizations that may come to Passkeys.

Would you be so kind as to point out what I’m the previous posting has been implemented, or what is outdated comparatively from this post?

1 Like
13

Maybe I‘m getting something wrong, but I think the other threads wants to use Apple‘s passkey for 2fa. And AFAIK, it doesn‘t make a difference from BW‘s side to implement it because it‘s already included in the Webauthn standard.

14

Hey all, I think the referenced post is about logging into Bitwarden without a master password or hardware key by using a passkey.

Currently you can use a passkey as a form of 2FA for your Bitwarden account, but the master password has not been replaced.

15

A way to implement this could be to use the hmac-secret extension of the FIDO2 standard. This is what systemd on Linux uses to implement unlocking luks encrypted disks using e.g. Yubikeys.

16

I like the idea. However, as you say it should be optional, therefore I think the title is a bit too strong (“Ditch the master password”). You might get more acceptance with a more moderately worded title.