Cool. I'm going to talk about an idea today.
Hopefully, some of you will like it, and I imagine some of you will really hate it or be worried about it. But it's going to happen, so just a warning up front. My name is Rew Islam. I work for a company called Dashlane, which is a password manager. I also spend a bit of my time in the FIDO Alliance. I co-chair a group called the FIDO Credential Provider Special Interest Group. It's not a working group. It brings together all the passkey password providers. Who here uses a password manager? Great. So you know what I'm talking about.
It brings together password managers like Dashlane, 1Password, Bitwarden, but it also brings together the OS vendors like Apple, Microsoft, and Google. And within this group, we discuss issues we have as credential providers and try to evolve the standards within FIDO to the user's benefit, but to help us as well to do good things.
So today, I'll talk about password management. I kind of will skip over it, seeing everyone knows about it. I'll try and cover some topics that you may not be familiar with. We'll talk about bad things, such as CSV exports, and scary things like passkey vendor lock-in, and then I'll go into the new standards and how we got there in the timeline. There'll be a few video demos that will demonstrate what I'm talking about, because a lot of this isn't really clear until you've seen it in action. But I want to start with password management.
So password management has been around, I mean, this is an article from 2017, but at that time, I think password management has been around for about 20 years. But like a lot of things that have been around for a long time, when Apple do it, it's kind of like a new thing. And in 2017, what Apple did, if anyone has an iPhone here, is they allowed you to autofill passwords above the keyboard. So you tap that, and it autofills, and it also generates passwords for you. The reason I'm highlighting that is that's really when the masses got access to a password manager.
Apple did have their keychain product, but they didn't really have a UI to integrate with it. And at this point, there was obviously a concern, well, does this kill the password manager, as in the third-party password manager?
Well, not really, because the year later, 1Password, Dashlane, and LastPass lobbied hard Apple to allow this functionality to be available to third parties. And whether that lobbying helped or not, I can't say, because Apple are very secretive, but they did introduce third-party password autofill, which is great. It's not as great as the first-party experience, but, you know, can't complain too much. So by this point, password management was a mainstream thing, and there were first-party and third-party, and you could move from one to the other.
If you got fed up with just living in the Apple world, you couldn't decide you want to get an Android device, and you can move all your passwords from one thing to another. Same if you started using Dashlane, and you wanted to move to Bitwarden, you could do it. And the way you did it was with this thing. This is the CSV file I was talking about. So it's really bad, and I noticed it was really bad when I saw the teams at Dashlane working to import CSV files from different products, and I was like, why is this complicated?
This doesn't seem that complicated, and it was complicated because every product does their own thing. So it decides which column is which data type, which data types to include. So if you don't know that Apple creates a CSV file like this, you won't be able to ingest it and import the data. So that's kind of the second point, which is there's no standard. The first point, probably the most important one, is you've now got a file with all your credentials in it, which sounds a bit scary.
Sorry, and there's no encryption to this file, so this file gets spat out by your exporting product, sits on desktop, maybe goes to Dropbox, maybe you email it, and now it's wherever it is. But at the end of the day, you're protecting phishable credentials here, so it's okay. We can deal with it. By the way, this isn't something that only third-party products do, like Dashlane, 1Password, Bitwarden. Apple and Google also do this.
It's maybe sometimes hard to find the option, but you can get all the passwords you have stored in your iCloud keychain account, or now Apple passwords app, and dump them out into a file, and then you can move that file to the product where you want to go to.
So when I saw this problem at Dashlane, I was like, there's got to be a better way to do this, and that got me thinking about how can we come up with maybe a standard just between password managers, because I'm not a standards person from my role, but I just thought maybe we can just talk to the other password managers and we'll come up with a solution. Anyway, in parallel, something else happened which made this problem a lot bigger.
In 2022, as most of you will know, hopefully you've attended some of the other talks around PASKIs, but in 2022 PASKIs didn't really exist as a thing. Apple, Google, and Microsoft committed their support to FIDO standards, and I don't think at that time the term PASKI was widely understood to mean synced PASKIs. Apple clearly had used the term, and over time it did become a thing. Third-party providers looked at this like Dashlane and were like, oh no, they're going to replace the passwords. We're password managers.
We should maybe think about what we manage, if it's going to stay with passwords, or can we also manage passwords. At the time, there were no APIs for third-party providers to manage, but we kind of figured out ways to do this on the web via browser extensions and whatnot. I won't go into all that detail. It's kind of controversial and people get upset when you talk about browser extensions, but all third-party providers, Bitwarden, Dashlane, 1Password, LastPass, sorry, others do have browser extensions that do PASKI management for the user.
So even though Apple, Google, and Microsoft said, look, hey, this is great. We have PASKIs. We actually had a lot more more actors that were interested in managing PASKIs and did manage PASKIs. Going back to the CSV problem, we had a great way, well, not a great way, a terrible way to move passwords around, but there wasn't a great way to move PASKIs around, and some corner of the internet did kind of go wild about this.
They saw this as a way for big tech or small tech to lock users into their products because once you start collecting those sync PASKIs into a product, well, you're stuck with that product, and if you really want to use another product, you kind of have to re-enroll new PASKIs in that other product and try and delete it. It just becomes a mess. So going back to the CSV file issue here, this became a big driver for having a standard for credential exchange, and that's what Dashlane worked on outside of FIDO to start with. We worked with 1Password, which I'm sure many of you are familiar with.
We came up with kind of a concept, like a proof of concept, and this is what the concept looked like. So this will loop, so I'll try to explain it. So you have one product on one side, one password manager, and then another password manager on the other side. You start on the importer where you drag this box over, and then it magically gets filled with all your items, and then you drag it over and drop it in.
So that was like the conceptual idea of the credential exchange, but underneath what's actually happening is the first drag, you're actually pulling a public ephemeral public key over, you're doing some Diffie-Hellman to come up with a symmetric key, and then you're encrypting the data, providing the public key of the exporter back to the importer, and then all the data gets decrypted. So even though this is like gimmicky, underneath the hood there's no secrets left behind. There's no secrets living on the disk, there's no secrets in memory, other than obviously the app that's running the data.
And we took this to FIDO. We presented it at a plenary in 2023 in Dublin, and we were curious about what their opinion was of this. We were a bit nervous. Apple and Google kind of loved it. They thought this is great. I don't know exactly why they loved it. You can come to your own conclusions about that, but that was a positive thing. I was happy that they liked the idea. So this meant that we could actually now start working on a standard within the FIDO alliance.
This could have been developed in another standards body, but all the right people were in the alliance, so it kind of made sense to do it there. Dashlane and other companies, they're not as big as Apple and Google, obviously, so we have limited resources to join all sorts of standards bodies, and we're already in the FIDO alliance, so it made sense. So this evolved from this highly conceptual idea of credential exchange to more of an evolution.
And again, this is a stepping stone to the final result. The challenge was, well, that's on desktop. How do you do this on mobile? How do you go from one app to another on mobile? And the idea here was you can map that, dragging the box over just between these screens. So you start at the importer, you hit import, and potentially the operating system presents you the products that can export data to you. So there's some OS-level integration going on.
Obviously, there's authentication going on at the right steps. It's not like an open bar. You can just move stuff around. You go to the exporter, so you select your exporter, you go to the exporter, you export, and the importer ingests that encrypted file. So the public key movement is kind of all going on when you jump from A to B to C. That was the high-level idea at the time. So where are we with this? So there are two standards. One is defining the actual cryptography, how to make sure that the movement of the data is safe, and that ticks that box of security.
The other one is dealing with the lack of standard of the data types. So how do we formalize what these things look like? And when I say what these things look like, it's the things that password managers typically manage.
So yes, of course, we have passwords in there. We have secure notes, bags of strings, so not like verifiable credentials at the moment, but bags of strings of, let's say, passports, driving licenses, etc.
And also, we can do now passkeys, because this is all encrypted and it's all safe. So private keys get dumped into this, and we define a format that we're all happy with. We didn't have to define one, actually. The passkeys were already formatted in a way we could use them. And this is all done in JSON. And this is from not so long ago in ReviewDraft, and the CXP standard is still being evolved. It's in WorkingDraft. These are publicly available. You can go to the FIDO Alliance website and look at the list of specifications, and you'll find them there, and you can read them to get an idea.
Just to mention that the CXP protocol is using something called HPKE. If you're familiar with that, it's just to put some more formality between public key encryption and also the symmetric part of the encryption. These are all the different types that we've standardized. This is still evolving. If people have a strong need for another type, that's not necessarily password manager related. I think this can accommodate it, but these are typically the bags of string I was talking about that password managers deal with. And this is a tech preview, so please don't read too much into this.
This is an Apple implementation of the standard, so it's mostly UI, but you'll see that here's the export screen. The user does some authentication. They're leaving the Apple Passwords app. They go into Dashlane. They click Dashlane. They authenticate into Dashlane.
Again, this is tech preview, very rough and ready, not really final, and the item ends up in Dashlane, and they're able to use it, which I think will be demonstrated shortly. So, here the user is signing in with an item that was just imported from another Parsky provider, and you'll see that hopefully it works.
So, the user gets logged in. So, that's it. Parsky's been moved. And on mobile, here's a demonstration of moving from one product to another.
So, you go to the exporting app. It's not exactly how I described in the visuals, but this is evolving still. The standards are good, but the UI and the user experience is still to be worked on. And as I said, there's tech preview on the OS level. Hopefully in June with WWDC, we start to see the finalized version from Apple, but Apple don't announce future plans, so I'm hoping, but I don't know for certain. As you can see, the item's now been moved to Dashlane, and it can be, so not only Parsky, but Passwords, and you'll see that the Parsky will also work.
I don't think we need to prove it, but there we go. I'll skip this one as I'm running out of time.
So, the standardization timeline, I don't really know how long things take to get standardized, but I think this one's moved fairly quickly. We proposed the idea to the Viya Alliance in 2023.
In 2024, the working drafts were published. We have a review draft from earlier this year. I'm expecting public releases at the OS level, and the OS level also implies all the products like Dashlane and others will implement their apps when the new versions of the OS come out.
iOS, Android, sorry, Apple, OSes, and Android, and a lot of these products are browser extensions, but there's no OS involvement there. That will rely on each of us agreeing how to do it between us, and we're working together. That's the helpful thing about that group in the Fido Alliance. We're all there. Even though we're competitors, we kind of work together to make sure that this works out.
So, hopefully by the end of 2026, the two standards are finalized and published. And we're asking for feedback.
So, please, if you go to this link, you'll actually see the links to the drafts that I mentioned, and it's just a GitHub repository where you can create issues. So, if you have any questions or things that you want to add to the spec, you can include them there. And I think I'm going to end a bit early, so we have some questions.
So, thank you very much for listening. So, in the end, that was really fast. That's good. And I think it's a crucial topic, questions. There should be one, at least one, in the room when it comes to migrating credentials from one app to the other. Don't be shy. What are you worrying about when it comes to this? Should you worry? I think it means everyone loves the idea. Does anyone currently use a product that they'd like to change, or at work they're using a product that they haven't changed from because it's a pain to migrate? Care to say which one?
Or care to say the issue that you're experiencing? No, thank you.
Okay, fine. That's understandable.
Okay, that's fine. I can see how this works. A while ago, there was an issue with LastPass, so then I migrated to one password. Manually? With the CSV. And then you have the replication, and it scared the living soaks of me.
So, yeah, it looked very cool. Yeah, and in that case, you wouldn't have, if there were passkeys in LastPass, you would not have received them via the CSV file.
So, this is what's going to solve that issue. Yeah. Perfect. If there are no other questions, you are released. Thank you very much for the presentation. And it's a nice approach. Really like that. Thank you very much.
