Passkeys: Require UV = User Verification (or another security mechanism for stored passkeys)

[Nail1684]

@DenBesten I think that (valid!) whole point was discussed last year in this thread:

Does Bitwarden need to do User Verification anew for each authentication ceremony?

A side discussion arose in the Feature Request thread “Passkey User Verification Independent of Vault Unlock Method”, about whether it is even necessary for Bitwarden to require a new User Verification (UV) each time that a passkey is used for authenticating to a Relying Party (RP) that has specified that UV is required. To avoid diluting the actual feature proposal in that Feature Request thread (to make the UV method separate from the vault unlock method, given that Bitwarden is going to requ…

As all posts alluded to UV, I think this Feature Request should stand now mainly for “requesting UV” in general.

But maybe another Feature Request could/should be opened, requesting specifically (and only) a “security mechanism/protection” for the stored passkeys, that is different from UV (i.e. not UV). ?! (like also suggested: with a separate password, PIN, biometrics… though, you are probably right as it would probably be a similar mechanism like master-password-repromt, which e.g. doesnt “add” to the encryption and can be circumvented)

With the first implementation of UV last year (June 2024), there was also opened a feature request about requesting UV independent from the chosen unlock method (as it was implemented last year):

Passkey User Verification Independent of Vault Unlock Method

Background: As of version 2024.6.0, Bitwarden passkeys now honor requests by Relying Parties to require User Verification. Currently, this results in the user being reprompted for their Bitwarden Master Password (or alternative vault unlock method) any time that they use a passkey for which User Verification is required (see PR 8746). For those who have strong Master Passwords and vault unlock PINs (something that Bitwarden presumably encourages), this new behavior can create significant frict…

I’m not sure for all systems/OS, but for Windows, there are indications, that the OS will probably carry out UV, probably coming this year - some speculations to that here:

Third-party passkey manager support in Windows 11

Microsoft has announced support for third-party passkey managers in Windows 11: Third-party passkey manager support - Windows apps | Microsoft Learn Does Bitwarden have plans to support this in the near term? That would be really neat, because I feel like lack syncability of passkeys across platforms is a major issue that needs to be solved for it to really take off as a viable alternative to passwords.