Forum Discussion

amh686's avatar
amh686
New Contributor
1 hour ago

I *really* need to turn off passkey support

I use 1Password everywhere: on Apple devices, on linux, on Windows, etc. I generally use the web app and browser add-ons on desktop.

However, my day-to-day work environment is late Ubuntu. What I don't have on my (ThnkPad) laptop is any working 2nd factor auth (fingerprint, facial recognition, etc). I do have a fingerprint reader, but it is useless on Ubuntu; besides, my laptop is habitually closed, so I could not even try to use it.

I use Firefox on Ubuntu and cannot possibly change to a different browser for my general usage.

I have turned off Offer to save and sign in with passkeys in the browser's 1Password plugin settings, but my problem is that 1Password still prompts me regarding passkeys. If I am not careful (if I foolishly attempt to interact with these prompts) I quickly end up in a lose-lose situation, where 1Password (at least, I think it is 1Password at this point) persists in prompting me for a passkey but, since I have no bio security auth available, I now go round and round in a loop.

As my posting title says, I really really need 1Password to stop trying to use passkeys in all circumstances. As an alternative, I might be happy with a USB fingerprint reader that works reliably with my P16 gen 1/2, but it would have to be a 'safe' reader: for example, it shouldn't store the fingerprint data on the reader itself and simply send a YES or NO, to the authentication routines running on the laptop.

FYI my wife encountered a similar situation recently. She has a Mac Air and was prompted to upgrade her 1Password installation. While she was doing this, she started seeing prompts for fingerprint auth (though these did not explicitly mention fingerprints) and, for the life of me (and I am an experienced engineer) I could not tell if these were coming from 1Password, from Safari or from MacOS: I did think they were probably coming from at least two of these. With my help, she fought through all of this and 1Password was re-installed, but she was very confused, even angry, by the end.

Like other people, I fail to see how passkeys help us and make us more secure. Much of the problem stems from the fact that each platform, and sometimes different apps on the same platform, treat passkeys differently, so the user experience is a complete mess. I realise that passkeys can help combat phishing, but 1Password already warns me if I am trying to use credentials for one website on a different one, which goes a long way to mitigating the problem. If a user decides to use passkeys in the way god intended, s/he is likely to have more than one hardware token and enroll the same website (passkey) on each one, which is a complete waste of time. I appreciate that 1Password is trying to help us users, by making passkeys portable, but this negates one of the planned features, which was that they would require a user to provide 2nd factor auth on a single device, as part of the login process.

However, today I would like to see my small problem fixed, so I never see passkeys again. We can leave the future of passkeys for another day.

passkeys

1 Reply

  • 1P_Dave's avatar
    1P_Dave
    Icon for Moderator rankModerator
    1 hour ago

    Hello amh686​! 👋

    Thanks for reaching out. You can turn off passkey support with these steps: 

    1. Open your browser.
    2. Right-click on the 1Password icon in your browser's toolbar and click Settings.
    3. Turn off "Offer to save and sign in with passkeys".


    You'll need to follow these steps in each browser and browser profile where you're using 1Password. It sounds like you've already toggled off "Offer to save and sign in with passkeys" so you shouldn't be seeing any passkey prompts from 1Password. Can you please post a screenshot of the prompt that's still appearing in your browser? That will help me to better understand the situation. 

    Like other people, I fail to see how passkeys help us and make us more secure.

    Unlike passwords, you can’t create a weak passkey. Passkeys are generated by your device using a public-private key pair, which makes them strong and unique by default. Passkeys can’t be phished like a traditional password because the underlying private key never leaves 1Password – this also makes them resistant to social engineering scams.

    Passwords, even those supplemented by a TOTP authenticator app, can still be phished. You can still be tricked into entering your password and TOTP into a fake website that masquerades as the real website. A passkey solves this problem since it can only be used with the original website that you created it for.

    Two-factor authentication was designed to add an additional layer of protection to passwords against phishing. As mentioned, passkeys are already resistant to phishing and can be considered to have the same level of security as a password plus two-factor authentication, with a lot less friction.

    -Dave