Follow-up on "Bitwarden Passkey Creation Blocked by Swiss Post"

Ask the Community Password Manager
, ,
1

Dear community,

I have a follow-up question related to the already closed thread Bitwarden Passkey Creation Blocked by Swiss Post : I’m trying to create a passkey for SwissID and store it in my self-hosted Bitwarden instance. Since I don’t have an Apple device (only Windows, Linux, and Android), the mentioned workaround doesn’t work for me.

So if I understand it correctly, there are two problems:

  1. SwissID enforces the password manager to be certified by the FIDO alliance.
  2. Bitwarden is not certified by the FIDO alliance.

While I want to ask the guys from SwissID about why they require #1, I’d also like to understand the reasons behind #2 - is this certification costly?

Thank you for your thoughts!

CC: @Axel

2

According to the FAQ, SwissID supports passkeys stored in WIndows Hello, or in Google Password Manager accessed via a Chrome browser or an Android device with Android SafetyNet Attestation. Have you tried creating a passkey using one of these methods?

3

Well, I guess there is a third problem:

I didn’t look through the whole site of the FIDO Alliance now… but I found this relatively recent and, I think, relevant discussion: https://groups.google.com/a/fidoalliance.org/g/fido-dev/c/swhoyE1mtG0

I didn’t read the whole conversation – but according to Tim Cappalli (Okta, formerly Microsoft) from May, it seems “There is no current certification for passkey providers.”

(and my own impression was, that mainly (or only?) security keys are FIDO certified at the moment)

PS: When “Windows Hello” is certified, it might count as a “platform provider”. (and Tim Cappalli probably meant third-party passkey providers where there is no current certification process…)

1 Like
4

Vendor-neutral certification is not the only possibility. Microsoft Entra ID maintains their own list of eligible AAGUIDs from which one can chose. Swiss Post’s supplier could conceivably be doing the same.

1 Like
5

Yes, using Windows Hello works without any issues. But how can I transfer this passkey into Bitwarden so that I can use it on my phone, too?

6

Export of passkeys is a relatively recent extension of the FIDO2 standards, which has been implemented by Apple, but evidently not by other ecosystems. Thus, unless you have access to an Apple device, the only recourse may be to try to have patience and wait until passkey export is supported by Microsoft.

7

Thanks to all of you for your helpful explanations, very much appreciated.

Based on that, I wrote the SwissID team and asked for some clarifications. Let’s see what they’ll say, I’ll keep you posted.

Merry Christmas :christmas_tree:

2 Likes