Time to pay up! Exporting is impossible on Apple's implementation of Passkeys. Even exporting your entire keychain of passwords doesn't result in any WebAuthn keys, just standard passwords. Tested on macOS 13 and iOS 16 betas. I sincerely doubt this will change with the official releases.
Google's implementation is probably the same.
Microsoft hasn't done a thing yet to support passkeys besides what Edge and Windows Hello do.
Interesting, I’m not running the betas and I searched a bunch before I posted and couldn’t find it mentioned one way or the other. I hope that changes sometime in the future, though I only use 1Password anyways.
Not GP but the EFF is the charity most likely to help successfully push for changes here :) I am sending them 50 bucks in your name. Care to double it?
Exporting is purposefully made impossible in many implementations of Passkeys (aka Webauthn authenticators) other than Apple's. For example, Yubikeys are designed so private keys can never leave the authenticator [0]. Enabling the export of private keys from an authenticator greatly increases the attack surface of an authenticator.
This is a long-standing security/usability tradeoff in the Webauthn spec. Various solutions have been proposed, but as far as I know most of them are still just drafts, e.g. [1]. The best practice has been and, as far as I know, continues to be to register multiple authenticators, e.g. a primary and a backup authenticator. This practice has a variety of benefits:
1. Avoids lockout if an authenticator is lost.
2. If you use multiple authenticators from different vendors (e.g. Yubico and Google) you:
1. Avoid vendor lock-in
2. Can rapidly respond in case a security vulnerability is discovered in one of your authenticators, as has occurred for both Yubico [2] and Google [3].
One could use Apple's Passkeys as one's day-to-day "personal" authenticator, and use an authenticator from a different vendor (e.g. Yubico Yubikey or Google Titan Security Key) as their backup key. I don't see how Apple's implementation increases the risk of lock-in beyond that of any of the other major Webauthn authenticator providers.
