Passkeys?

[WillKirk]

When logging into this community site to make this very post, the login page for the password has a section called Passkeys. This is what it says when clicked on:

Passkeys

Passkeys are a new alternative to passwords.

When you set one up, a pair of secure digital keys are created. One key is stored on your device and the other is shared with us. When you log in to our app or website, we check your device has its key and confirm you're authenticated with your fingerprint, PIN or face ID. If everything matches up, you'll be passed straight into your account.

Passkeys are more secure than passwords as they require your physical device and can't be leaked online.

To set up a passkey, visit the security section in your Profile.

Now I know what Passkeys are, and use them on other sites, but I am unable to find the 'security section' where I can use them with EE, nor can I find any tell of them anywhere else on the EE Community or website - yet the information is there as if there 'should be' Passkeys available as a login option.

Anyone know more about this?

[Roke]

Support has existed in Bitwarden for at least two years.

[Roke]

You'll see an option to at https://ee.co.uk/exp/manageid/profile/login-information.

[PrivateP]

Hi,

newbie here.

I use passkey on my mobile and my desktop.  I use a vault that allows me to be separate to all operating systems; i.e I can login via iOS, Linux, Mac and Windows. This is for many sites.

I might be incorrect but it seems the so called passkeys are 2FA really and once submit your UID / Password it result in a PIN (a message) to your mobile only.

Simply put I cannot use a actual passkey from ee as they do not supply such. As stated there is a PIN sent which is analogous to an authenticator app (Google/Microsoft or otherwise).

There are variations on how actual passkeys are implemented IRL, Google just asks for your email and then triggers a passkey request and you are in, Amazon is slightly different where you must provide UID/PWD and then select passkeys and you are in.  This applied to mobile and browser - it makes no difference and is transparent.  i.e I use the same passkeys from my vault on browser and mobile as it is independent of the operating systems.

From my experience the ee passkeys are NOT real passkeys but an implementation of 2FA.
Maybe I am wrong and if someone could explain the implementation IS using passkeys, I would appreciate it since I cannot find the actual passkey presented anywhere.

[Roke]

@PrivateP, CTAP2 (FIDO2) passkeys permit 1FA authentication, whereas CTAP1 (U2F) passkeys are 2FA-restricted. However, this solely describes their capabilities. EE appears to have ignored the unnecessity of entering an e-mail address for CTAP2 1FA, and it still sends SMS 2FA after the user uses their passkey as a mere replacement for their password. This is a failure of EE's implementation.