Passkey and unlocking 1Password with it (biometrics) in iPhones

Just a minor correction to avoid confusion: the correct word here is "passcode

You can configure a passcode to be a custom alphanumeric code.

That’s more like a password and you don’t have to reuse it anywhere else.

my iPhone password
Just a minor correction to avoid confusion: the correct word here is "passcode" 🙂

Indeed, we all know that we shouldn't be using the same password across services, so that if a password is leaked, the attacker can't get into other services/apps.
And yet, unfortunately, nowadays the iPhone Passcode is like a password reused in various places.

XIII

my 1Password account, since that passkey will have to reside in iCloud Keychain

And that’s my original point. If it’s in iCloud and someone, somehow saw my iPhone password to get into it, they will have access to my 1Password if they take my iPhone (like in the links in my original post).

1P_Dave No need to convince me about passkeys; I’m going to use them everywhere I can (and stored in 1Password).

With possibly 1 exception: my 1Password account, since that passkey will have to reside in iCloud Keychain. While the chance is small that I lose my iPhone, iPad, and MacBook in the same event, it is not zero. A passkey would still be my preferred way of logging in to 1Password, but I would like to have an analog backup (like the current Rescue Kit).

I think that it is very concerning that Apple's implementation of passkeys authentication in iOS falls back to Passcode after a few failed attempts using FaceID / TouchID.

While having a complex Passcode and using these biometrics to unlock the iPhone reduces the risk of being a victim through shoulder surfing, it doesn't help when muggers coerce a person to hand over their iPhone and to reveal their Passcode at knifepoint.
This is happening nowadays, where muggers use the Passcode to log the victim out of other Apple devices they might have and change their Apple ID password.

And now with Passkeys, they can also authenticate into any services which the victim has configured to sign into using Apple passkeys.

For that reason, I consider very risky to configure 1Password to be unlocked using Passkeys on iOS. I know this it not mandatory as you wrote, 1P_Dave, but I think that most iOS users are probably not aware of this risk, and 1Password could probably highlight it.

Also, Apple really should, in my opinion, give iPhone users the option to specify that they don't want to allow the Passcode to be used to authenticate Passkeys (and also not to allow it to be used to change the Apple ID password).

Any thoughts on this, 1P_Dave?

To answer the way above question.
Does anyone know whether a hardware key with apple 2FA prevents reseting Apple ID with just a trusted device?
I know this is off topic, but to answer your question.
If you lose both keys–or they’re stolen, broken, or destroyed–you can still rely on trusted devices to regain account access or remove keys and enroll new ones. However, if you can’t use your security keys and lose access to all trusted devices, your Apple ID account will likely be unavailable forever.

If I do the following:

1. Lock my phone while 1password is unlocked and running in the background.
2. Block my face and unlock my phone using the passcode.
3. Reset Face ID using the passcode.
4. Set up Face ID.
5. Bring 1password to the foreground

1password is still unlocked.

Do I have something configured incorrectly or is there a way to force 1password to lock when I unlock the phone using the passcode?

OK, I think I figured out how to make this work.

It looks like 1password "Auto-lock on Exit" needs to be set to Immediately.

1P_Dave Does this sound correct?

XIII

Passkeys can provide the same level of security as password + two-factor authentication, with a lot less friction. It isn’t necessary to use a separate multi-factor authentication solution on top of a passkey. Passkeys cannot be remotely phished, socially engineered, or leaked. Those are the threats that two-factor authentication was designed to protect against.

If you'd like to continue using an account password, Secret Key, and your security key then you'll be able to continue to do so rather than using a passkey to unlock 1Password.

-Dave

Will I be able to use both a passkey and a (physical) security key (back up) to unlock my 1Password account?

1P_Dave

The attack that you mentioned would require that a malicious actor has access to both your physical device as well as that device's passcode.

That’s my concern. Let’s say I had a 6 digit pin and someone saw me put that in, and then took my phone. The attacker had my phone, my 6 digit PIN, so wouldn’t he have access to my passkey that unlocks 1Password and able to get into my 1Password? I feel like my iPhones password is now weak link in this new set up.

I have a long alphanumeric password, but then again, in the new passkey set up, that’s protecting my 1Password.