Feature request - Please adjust the popup's behavior for passkey creation

Hello @nicos18!

I'm sorry for the confusion. Both passkeys and security keys use the same underlying webauthn technology which is why you're seeing the prompt from 1Password appear in your browser. If you'd like to add a physical security key for two-factor authentication to your Github account you can click on the security key icon in the prompt to dismiss 1Password and use your security key instead:

If you'd like to save a passkey for sign-in to your Github account, not a security key for two-factor authentication, then make sure to select the appropriate option on the Github website.

Let me know if you have any questions.

-Dave

Hello @1P_Dave,

Thank you for the explanation.

As 1Password detects both a passkey and a physical security key as a same thing, a workaround that I found is to add to the main item a passkey, and then create a second item for the security key; in this way I can have both elements.

But I hope that, in a future build, 1Password will support more than one passkey stored, as not all services provide the option to upgrade a physical security key to a passkey (at this time, I only found GitHub offering this option).

Thank you.

@nicos18

Thanks for the reply. Two-factor authentication (like physical security keys) was designed to add an additional layer of protection to passwords against phishing. Passkeys are already resistant to phishing and can be considered to have the same level of security as a password plus two-factor authentication.

You only need to save your passkey for sign in in 1Password, there's no need to save the security key as a passkey in 1Password as well. This advice is consistent with what Github says in their official documentation:

Once you have added a passkey to your account, you can use the passkey to sign in safely and securely to GitHub.com without having to enter your password or perform two-factor authentication (2FA).

I hope that helps. 🙂

-Dave