In a significant development for password security, the FIDO Alliance has announced new specifications for passkeys, enabling users to import and export them securely. This move aims to promote user choice and flexibility in managing their authentication credentials.
Passkeys, introduced two years ago, replace traditional passwords with more secure authentication methods using security keys or biometrics. However, the current system has a major limitation: there is no secure way to transfer passkeys between different password managers. For instance, if you have stored a passkey in Apple’s Passwords app, you cannot easily move it to 1Password or another password manager.
The new specifications, published by the FIDO Alliance, address this issue by introducing the Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) formats. These formats enable the secure transfer of not only passkeys but also other types of credentials. The new formats are encrypted, ensuring that credentials remain secure during the transfer process.
In contrast, most password managers currently rely on CSV files to import and export credentials, which is a less secure method. The new specifications have been developed in collaboration with several companies, including 1Password, Dashlane, Bitwarden, NordPass, and Google.
1Password has already committed to supporting the new passkey import and export formats as soon as they become available. Although Apple has not made an official statement, the company is part of the FIDO Alliance and was one of the first to introduce support for passkeys in 2022 with iOS 16.
Who is the FIDO Alliance?
The FIDO Alliance is a non-profit organization that aims to develop and promote open standards for authentication and identity verification. Founded in 2013, the alliance brings together industry leaders from various sectors, including technology, finance, and government, to create a more secure and user-friendly authentication experience. The FIDO Alliance’s mission is to reduce the world’s reliance on passwords and replace them with more secure and convenient authentication methods, such as passkeys. With over 250 member organizations, the FIDO Alliance plays a crucial role in shaping the future of authentication and identity verification.
The new passkey specifications are expected to enhance user convenience and flexibility in managing their authentication credentials. However, it is unlikely that these specifications will become available later this year, as the drafts still need to be reviewed by the industry.
The development of these new specifications is a significant step forward in promoting password security and user choice. As the technology continues to evolve, it will be interesting to see how different companies implement these new specifications and enhance their password management services.