There are two types of passkeys.
Device Bound – stored in hardware on your computer; can only be used on the one computer, so you need to enroll on the website once for each device you want to use.
Syncable. – stored in a password vault and can be copied to all your devices, so you only need to sign up once per website.
Bitwarden only supports “syncable”. I believe Apple demands device-bound.
@kotgc Welcome to the world of “peculiar” passkey implementations!
From your first screenshot:
So, yeah, Apple requires you to only use passkeys from iPhones (or iPads?) here… For better or worse, they can decide how to implement passkeys – and restrict it if they want to.
Thanks for the clarifications, I’m trying to get my head around the ‘new’ security.
Lol, on the iOS18.5 logging into the same website, there’s no option to sign in with a passkey, just the Apple Account sign in (which I assume is stored on the Apple chain thingy). I would prefer to use the Bitwarden app (so all my security is stored in 1 place for easier management). Ideally this will all be passkeys and no more passphrases. After about 30 seconds when not selecting the Apple password sign in (somehow the usual Bitwarden prompt to auto populate is not present), the Apple website option appears: Sign in with Passkey. I select Sign in with Passkey → Use Face ID to sign in? You will be signed in to “apple.com” with your passkey for “my_old_email@domain.tld” → Continue or Other sign in options→ the website is then logged in, but I’m only assuming it’s logged in with the passkey (from Apple’s chain thingy?) → now I need to figure out how to update from my old email to a current email; and then how to manage Passkeys with Bitwarden.
Long story but I never used password manger auto populate, so passphrases are so simple to type in, but the 1 honey pot (online password manager) is vulnerable. My understanding is passkeys solve this by storing the public key on the password manager and the private key on my device. So hackers have to do twice the amount of hacking to get lucky.
Imho, syncable seems like the way to go, device bound seems like the old corporate wars in spite of confusing Pavlov’s dog…uh I mean innocent consumers.
The public key is retained by the website to which the passkey belongs.
The private key is either stored in your bitwarden vault (for syncable passkeys) or your device’s hardware-security-module (for device-bound passkeys).
I do recommend using one of the various autofill mechanisms for passwords whenever possible. Autofill offers two significant security benefits: It will not work if you are unexpectedly on a look-alike website, and it makes it no-big-deal to have long, random, and unique passwords for each website.
Challenge is for tech learners, autofill has an opaqueness and obfuscation to it, with corporate wars sewing confusion in vulnerable minds.
Passphrases counter the ‘Pavlov tactic’ of overwhelming learners, by handing control to the learner, until the learner is comfortable, understands and has control of the bombardment of prompts to use this or that password manager product (sometimes illegitimate products too, like download now pay for ‘precious photo saver’ or lose everything). This is another topic though and although interesting, I have marked the query solved.
Thanks to all, with good mana and potions to good people
The distinction between both types of passkeys is mainly a result of where you store them. And that has the consequence that they have slightly different “properties” then. (the ones are syncable, the others are not)
Device-bound / hardware-bound passkeys (like stored on physical security keys) are not “outdated”. Usually they are seen as stronger (“more secure”) as syncable passkeys. – And the security of both kinds of passkeys depend on how good the “wallet”, where the passkey is stored, is protected.