Future Passkey Support #3355
Replies: 30 comments 119 replies
-
When someone has the time to write the change, plus however long it takes to write the change based on complexity. |
Beta Was this translation helpful? Give feedback.
-
|
If you are revering to passwordless login i suggest to read this post: #2817 |
Beta Was this translation helpful? Give feedback.
-
|
Here's the Bitwarden feature request I'm referring to: https://community.bitwarden.com/t/store-webauthn-fido2-credentials-in-bitwarden-passkey-support/42153 As someone who isn't a Rust dev, how can I help once development can begin? (I understand that this is far out) |
Beta Was this translation helpful? Give feedback.
-
|
First this functionality should be provided for self-hosted, after that we can check and see if we can add this or not. |
Beta Was this translation helpful? Give feedback.
-
|
Bitwarden announced recently Passkey support : https://bitwarden.com/blog/bitwarden-passkey-management/
Is it planned to support Passkey in Vaultwarden ? |
Beta Was this translation helpful? Give feedback.
-
|
FYI that blog post was recently updated with the following note:
|
Beta Was this translation helpful? Give feedback.
-
|
This has been merged today: bitwarden/server#2679 🎉 |
Beta Was this translation helpful? Give feedback.
-
|
they planned an event on November 9 dedicated to passkeys, so it's coming really soon:tm: |
Beta Was this translation helpful? Give feedback.
-
|
aaaand, it's out :) |
Beta Was this translation helpful? Give feedback.
-
|
Does login to Vaultwarden via Passkeys (no masterkey) work now? |
Beta Was this translation helpful? Give feedback.
-
|
And it's finally merged: bitwarden/server#2679 🎉 |
Beta Was this translation helpful? Give feedback.
-
|
Awesome! |
Beta Was this translation helpful? Give feedback.
-
|
Now, what does that mean? I guess it has to be implemented in Vaultwarden first and also the Clients need to support Passkeys before we can use it, right? |
Beta Was this translation helpful? Give feedback.
-
|
That's correct. This means though that is very close to be officially released so the clients will support it soon, if they don't already. |
Beta Was this translation helpful? Give feedback.
-
|
Most of them PRs for passkeys have been merged also in the client repo bitwarden/clients#4715 🎉🎉🎉 |
Beta Was this translation helpful? Give feedback.
-
|
Can't wait for this to be released. |
Beta Was this translation helpful? Give feedback.
-
|
@danieletorelli did you have the time to look at the upstream PRs, can you estimate how much work needs to be done on the vaultwarden side? Referencing #3593, it seems that implementation was a little premature but laid most of the groundwork? |
Beta Was this translation helpful? Give feedback.
-
|
Unfortunately I don't have a way to estimate the complexity because I'm unfamiliar with both the codebases :( |
Beta Was this translation helpful? Give feedback.
-
|
Clients and Server for bitwarden upstream have been just released!!! |
Beta Was this translation helpful? Give feedback.
-
|
bitwarden/server : bitwarden/clients : |
Beta Was this translation helpful? Give feedback.
-
|
https://bitwarden.com/help/releasenotes/#2023-10-0
|
Beta Was this translation helpful? Give feedback.
-
|
I updated today (docker
I tried Firefox, but the plugin wasn't yet updated to version 23.10.1. Chrome's plugin was updated, and that worked. |
Beta Was this translation helpful? Give feedback.
-
|
You need Vaultwarden testing tagged images |
Beta Was this translation helpful? Give feedback.
-
|
Great! It works! Thanks |
Beta Was this translation helpful? Give feedback.
-
|
But why is chrome updated but not firefox it is "the same code"? |
Beta Was this translation helpful? Give feedback.
-
|
Because Mozilla needs to audit it first before they release a new version. |
Beta Was this translation helpful? Give feedback.
-
|
Oh yeah right and we all know chrome aint doing that /s |
Beta Was this translation helpful? Give feedback.
-
|
Working here also (Yubico playground) Now I just don’t understand other things! For example, sign into AppleId - how do I save a passkey for an existing account? I can try to sign in with one, but I’ve never created one. Can anyone help? |
Beta Was this translation helpful? Give feedback.
-
|
Look under https://appleid.apple.com/account/manage to set one up |
Beta Was this translation helpful? Give feedback.
-
|
Under that button is a text that it only supports IOS > 16 so only with a phone |
Beta Was this translation helpful? Give feedback.
-
|
Already running iOS 17! No idea why I can't do it. Just been adding passkeys to some sites such as Google, Github, Amazon. Working smoothly there 🤷 |
Beta Was this translation helpful? Give feedback.
-
|
Um, i think mobile support for passkeys isn't yet in there apps, only the browser extensions |
Beta Was this translation helpful? Give feedback.
-
|
Looking at https://www.passkeys.io/who-supports-passkeys, it suggests Apple/iCloud support may not be quite there yet. Which is surprising, because they've been pushing the feature... Could be it's only supported with iCloud keyring, which would be s**t |
Beta Was this translation helpful? Give feedback.
-
|
I'm not sure if this is correct but when storing passkeys in iCloud keychain, for everything OTHER THAN an Apple ID, you can actually see them stored in the password settings on both MacOS and iOS (synchronized). However, when storing a passkey for your Apple ID, it seems to store that in a different location that we don't see (i.e., it's not listed under the saved Passkeys in iCloud). Maybe it's only stored on device and not sync'd? That might make sense since you need your Passkey to get into your Apple ID (iCloud, etc.). I imagine that difference is somehow related to why we can't create a Passkey for an Apple ID in Bitwarden / Vaultwarden instead. I'm not sure what's going on, but it does seem something is different for Passkeys for an Apple ID than other site(s). |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
I agree, but their release note is misleading |
Beta Was this translation helpful? Give feedback.
-
|
Clear to me. It said you can only view and edit. Especially in support page: https://bitwarden.com/help/storing-passkeys/#passkey-storage
|
Beta Was this translation helpful? Give feedback.
-
|
“ Passkeys support for mobile applications is planned for a future release.” so it’s coming |
Beta Was this translation helpful? Give feedback.
-
|
I suppose so, fair enough. Regardless, the future is bright. |
Beta Was this translation helpful? Give feedback.
-
|
Is this out yet for mobile iOS clients ? So we can start using passkeys across all devices without being tied to the Apple systems? |
Beta Was this translation helpful? Give feedback.
-
|
When will stable be released? |
Beta Was this translation helpful? Give feedback.
-
|
Vaultwarden doesn't have any release schedules or something like that. So there is no eta of a new stable version. Though we probably release one in the 1.29.x range soon. |
Beta Was this translation helpful? Give feedback.
-
|
Will passkeys be in it? |
Beta Was this translation helpful? Give feedback.
-
|
It will be what currently is in testing, so yes |
Beta Was this translation helpful? Give feedback.
-
|
Good thx |
Beta Was this translation helpful? Give feedback.
-
|
Can you also use passkeys to log into vaultwarden? Currently my interface at "security" in my settings doesn't show anything about passkeys |
Beta Was this translation helpful? Give feedback.
-
|
@RazielKanos https://bitwarden.com/passwordless-passkeys/ "Sign into Bitwarden with passkeys Just wait for Bitwarden to release this feature first. |
Beta Was this translation helpful? Give feedback.
-
|
I can sign in with passkey as a Webauthn 2fa. Which is fine by me. Fully passwordless could be nice though. |
Beta Was this translation helpful? Give feedback.
-
|
Is this feature (fully passwordless login) planned? I would really appreciate it ... |
Beta Was this translation helpful? Give feedback.
-
|
Looks like many people got it to work, but I can't seem to get the Bitwarden passkey prompt shown even with testing tag. My Vaultwarden version shows 2023.10.0 and Chrome extension version 2023.10.2. |
Beta Was this translation helpful? Give feedback.
-
|
I believe you need to have websockets set up correctly for it to work. But someone can confirm. Double check your configuration |
Beta Was this translation helpful? Give feedback.
-
|
Websockets are not needed for passkeys |
Beta Was this translation helpful? Give feedback.
-
Websocket will be deprecated from next release so nothing to do with passkeys |
Beta Was this translation helpful? Give feedback.
-
|
Websockets aren’t being deprecated. What’s changing is that they work through the main port, ie not an extra port 3012. So some people need to update their config |
Beta Was this translation helpful? Give feedback.
-
|
Have you relogedinto your vault from the extention? |
Beta Was this translation helpful? Give feedback.
-
I'm having the same problem, passkey doesn't showup in my FireFox extension! Do I need to configure something else I don't know about? I see Github supports passkey (if it is the same feature) and would like to try that with Vaultwarden but I don't see the ability in my vaultwarden extension. |
Beta Was this translation helpful? Give feedback.
-
|
Passkeys as in YubiKey/Webauthn support? Because that works just fine. |
Beta Was this translation helpful? Give feedback.
-
|
reinstalled the FF add-on but still not working! |
Beta Was this translation helpful? Give feedback.
-
|
Try https://www.passkeys.io/ Works just fine for me. |
Beta Was this translation helpful? Give feedback.
-
|
Tried https://www.passkeys.io/ and it is working with VW FireFox extentions on a Windows 11 machine but not on my MacBook Pro with macOS 10.13 (High Sierra). Any idea how to get Github passkey to work with Bitwarden extension? |
Beta Was this translation helpful? Give feedback.
-
|
Github Passkeys work fine for me on macOS, i am using a chromium based browser tho (Arc). |
Beta Was this translation helpful? Give feedback.
-
|
Working for me on MacOS with Safari.
The only issue is that the passkey window can take 15s or more to show up. Vaultwarden is hosted on a Synology 420+ on my local network. I am connected with LAN. I’ve tested the same website with a passkey stored on Bitwarden.com and it show up in 2s.
|
Beta Was this translation helpful? Give feedback.
-
|
@Gandulf78 AFAIK its not Vaultwarden's issue, because all secrets are synced locally. Vaultwarden is just an remote centralized storage. |
Beta Was this translation helpful? Give feedback.
-
Ok. So it would be a browser extension performance issue with passkeys? Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
@Gandulf78 AFAIK yes. Passkey support in Bitwarden's extensions are quite immature, and doesn't work ideally yet. For example for me it doesn't work reliably in Ungoogled Chrome. |
Beta Was this translation helpful? Give feedback.
-
|
I had to log out and log in again in the extension before seeing the passkey popup from browser extension. |
Beta Was this translation helpful? Give feedback.
-
|
Tried the latest version, the testing version, and specifically selected the 1.30.1 version, but none of them shows the passkey option in webvault or in extension what to do |
Beta Was this translation helpful? Give feedback.
-
|
There is no passkey option or something similar. As suggest above try it on https://www.passkeys.io/ |
Beta Was this translation helpful? Give feedback.
-
|
Got it. It worked. But not working for google. |
Beta Was this translation helpful? Give feedback.
-
|
A temporary fix for the extension will soon be deployed for passkeys that don't work on Google |
Beta Was this translation helpful? Give feedback.
-
|
Does anyone know if there's a PR to track the development of the mobile client feature for passkeys? |
Beta Was this translation helpful? Give feedback.
-
|
I read all the entries, but at the end I'm confused a bit, so sorry for asking again: is there currently a way for passwortless login to vaultwarden using a passkay (from Yubikey oder Google Titan) by using the vaultwarden web-interface or the bitwarden app? |
Beta Was this translation helpful? Give feedback.
-
|
It is planned but not yet implemented: |
Beta Was this translation helpful? Give feedback.
-
|
Seems like password less sign in is now in beta |
Beta Was this translation helpful? Give feedback.
-
|
I really think this feature is not what you are looking for. The password less is not implemented in vaultwarden yet. Only login with another device who has a vault unlocked |
Beta Was this translation helpful? Give feedback.
-
|
no this is correct. But the issue is bitwarden doesnt accept windows hello pin as passkey.
|
Beta Was this translation helpful? Give feedback.
-
|
Finally coming to mobile too. Hope won't take too long to finish this PR |
Beta Was this translation helpful? Give feedback.
-
|
@ilbarone87 The bitwarden mobile app in iOS TestFlight now already support passkey login (work with vaultwarden 1.30.5 ), so just wait for the official release. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, I'm already using it. Seems alright. I only have one issue where in certain situations the app stop recognising the passkey. |
Beta Was this translation helpful? Give feedback.
-
|
Beware, I just locked myself out of an account because I saw the option "use passkey", went for it, it all worked but then somehow the key disappeared. Must be something to do with the official browser plugin in and lacking support if Vaultwarden? No idea. I should have investigated first... |
Beta Was this translation helpful? Give feedback.
-
|
What you mean? You always have the option to use the master key? Passkey ist just more convenient |
Beta Was this translation helpful? Give feedback.
-
|
Maybe the site @freekvh used does not allow anything else, which would be strange. But normally there is a recovery feature via recovery keys. |
Beta Was this translation helpful? Give feedback.
-
|
Which website it was? So maybe somebody else can try it |
Beta Was this translation helpful? Give feedback.
-
|
I'm having some issue with passkeys in Safari (latest version). If I try to click on "Sign in with passkey" button on passkeys.io the action doesn't open Bitwarden extension. Simply it does nothing. In the console I can see the warning: Does anyone know more about this? |
Beta Was this translation helpful? Give feedback.
-
|
It works for me. Have you signed up with passkeys.io already? E.g. you have signed up and created a passkey? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I signed up. I suspect Adguard is interfering with the process. Disabling it makes it work, not always, but most of the times. |
Beta Was this translation helpful? Give feedback.
-
|
If logins start moving toward passkeys, which is a way to eliminate passwords, what do you do when you jump on a shared or public computer and need to login? From my understanding of passkeys, and I haven’t started to use them yet since I’m waiting for it to mature a bit, you need BW browser extension to pass the passkey; this is fine if it’s your own personal device but what if it’s not? Or do you have to revert to the password in this scenario? |
Beta Was this translation helpful? Give feedback.
-
|
That's correct; for a login that has only a passkey, you won't be able to log in using a device (computer, mobile, etc.) unless it has the passkey available. If the site offers other login methods (like "forgot my password?" you may be able to use those. |
Beta Was this translation helpful? Give feedback.
-
|
Yikes! That sucks. That will definitely be a short fall with this. At my job we utilize cars that have computers in them, they have a frozen image so at restart any setup you do needs to be done again. Usually I just add the BW browser extension, but the time spent in a car is usually short and this is tedious to setup when jumping in random cars every couple of days. I wish they would implement some sort of way to send a push notification to the BW mobile client. |
Beta Was this translation helpful? Give feedback.
-
|
There is a solution for cross-device authentication using Passkeys. It's called hybrid transport or FIDO Cross-Device Authentication. It should be supported on most recent operating systems already. I have no knowledge if third-party clients like Bitwarden will be able to support it too. There is one catch, though. The device where you want to authenticate using the cross-device authentication needs a working Bluetooth Low Energy transmitter and a network connection. |
Beta Was this translation helpful? Give feedback.
-
|
I am confused. Has the support for storing passkeys already been implemented in Vaultwarden or not? |
Beta Was this translation helpful? Give feedback.
-
|
Yes I’ve seen the beta app crash as well, every time I added a TOTP from the browser extension. |
Beta Was this translation helpful? Give feedback.
-
|
2024.4.2 |
Beta Was this translation helpful? Give feedback.
-
|
I’m running Vaultwarden 2024.1.2 and the iOS app 2024.4.2 (7528). I don’t see anything related to passkeys… |
Beta Was this translation helpful? Give feedback.
-
It seems like one can't manually add passkeys. Whenever a website requests a passkey for login, the browser extension asks you to store or use the passkey, and once stored from there, you can see it in the web interface. The mobile apps don't yet have support for it. Well, the iOS app seems to have it, but on Android, it's still in beta. |
Beta Was this translation helpful? Give feedback.
-
Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Thought I'd post here since i've got one specific use-case where passkeys with the current Bitwarden chrome extension doesn't seem to work right, and I don't know if either the web app, the extension or Vaultwarden is at fault here. I'm talking about Miniflux v2 (https://github.com/miniflux/v2). I created a passkey and stored it in Vaultwarden, that part worked just fine. Whenever I try to login, Bitwarden tells me that it couldn't find a passkey and prompts me to either use local auth or cancel. Passkeys work fine in any other scenario though. Do you have any idea why that might be? Is it Miniflux related and I should open an issue over there? |
Beta Was this translation helpful? Give feedback.
-
Could it potentially be about a potentially different subdomain? Maybe it uses a slightly different domain or path for login, which Bitwardn/Vaultwarden doesn't recognize, as a different login page has been stored for the passkey. This is my suspicion, but also my only idea as to what could be going on for you. |
Beta Was this translation helpful? Give feedback.
-
|
I don't know really. I just tried again, deleted the old passkey from Vaultwarden and Miniflux and added a new one. Tried to login and it just says "no passkey could be found". I checked my Miniflux config and it got the correct base url to work with, but I don't know what the web authenticator actually sends as a url to Bitwarden/Vaultwarden that cannot be found. |
Beta Was this translation helpful? Give feedback.
-
|
There are other cases, I have same issue with Teleport Community Edition. Same behaviour. Passkey in vaultwarden doesn't seem to be recognised. Tried to delete and create. Creation works well but login doesn't work. |
Beta Was this translation helpful? Give feedback.
and others
-
This is probably way to preemptive, but I was wondering about passkey support when the Bitwarden team eventually includes it on their side. I've been getting more excited about passkeys/FIDO2.
I guess my question (not a fair one) is how long after passkeys are supported by Bitwarden will they get implemented in Vaultwarden? Or just any thoughts about passkeys from those involved with Vaultwarden.
Beta Was this translation helpful? Give feedback.
All reactions