Bitwarden has expanded its support for passkeys so that users can now log into Bitwarden browser extensions in Chromium based browsers using a passkey instead of a master password. The update applies to extensions for browsers such as Google Chrome, Microsoft Edge, and Brave. It uses the WebAuthn pseudo random function extension to enable passwordless authentication that is bound to Bitwarden’s domain.
According to the company announcement, users can register a passkey for their Bitwarden account and then select that passkey when logging into the web vault or unlocking supported browser extensions. The passkey is stored in a platform authenticator such as device biometrics or a hardware key. The private key remains on the user’s device. When the user logs in, the browser uses the PRF extension so that the passkey participates directly in the encryption process that protects the vault.
Bitwarden notes that the new capability is aimed at making vault access phishing resistant. Because passkeys are scoped to the service origin and do not reveal a reusable shared secret, they are less exposed to credential theft than traditional passwords. The company positions this as a way for organizations and individuals that are standardizing on FIDO based authentication to extend that model to their password manager.
The capability builds on earlier work that allowed users to log into the Bitwarden web vault with a passkey. With this update, Bitwarden says that passkey login now covers web vaults and Chromium based browser extensions. Support for other browsers is planned as additional vendors implement the WebAuthn PRF extension. Existing login options remain available, with passkeys offered as an additional method rather than a replacement.
Sources: Business Wire; Help Net Security; Bitwarden Blog
—
By the ID Tech Editorial Team
