# Passkeys without sync/backdoor with Google **URL:** https://discuss.privacyguides.net/t/passkeys-without-sync-backdoor-with-google/14090 **Category:** Questions **Created:** 2023-09-24T10:00:46Z **Posts:** 22 ## Post 1 by @ph00lt0 — 2023-09-24T10:00:46Z Trying to set up passkeys on Android. Suggests that this will be stored in your Google account. I cannot seem to find a way around this. Has any of you managed this? If so how can this be done? ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/f/f80c44370e194504c2fec87ef9eba881a1846b37.jpeg) N.b. this is not the same as using your phone as a security key. Same tech different implementation. --- ## Post 2 by @anon66890361 — 2023-09-25T09:04:59Z i don’t think there is a way around this. The documentation around this seems to be limited. I guess when they say passkeys will be stored on your device , it means it will be automatically linked to your account and synced to your other devices. A quick search for documentation shows that , passkeys are synced with your google account using google password manger and is supposedly “end to end encrypted”. source - [Passkey support on Android and Chrome  |  Passkeys  |  Google for Developers](https://developers.google.com/identity/passkeys/supported-environments) . So far i haven’t used this feature much. But i do have enabled passwordless login for github through my yubikey which is just like a passkey but stored on your separate physical device. so using yubikey for passwordless login looks much better option , if you don’t want to trust apple/google ecosystem. But for an average user passkeys should be much better option if the websites are compatible --- ## Post 3 by @ph00lt0 — 2023-09-25T09:07:59Z We agree on all things here. I just hate that it seems impossible to avoid Google here. It seems like a bad idea and I wonder how Bitwarden and 1password will do their implementation of key syncing in that case. You mention you stored a passkey on your yubikey for github. But does that allow you to login on android with it? The implementation with Google also does not work on GrapheneOS btw as it doesnt meet the sts (safetynet). --- ## Post 4 by @anon66890361 — 2023-09-25T09:41:07Z it doesn’t exactly seem to work on android for some reason . but it allows yubikey to be used after entering your login and password and then clicking on passkeys option --- ## Post 5 by @ph00lt0 — 2023-09-25T09:55:37Z Sure that’s the webauthn fido2 as security key MFA. But passkeys implementation doesn’t seem to work that way which is sad and slightly worrying --- ## Post 6 by @anon66890361 — 2023-09-25T10:00:15Z yeah i kinda hoped that when websites start supporting passkeys , webauthn fido2 would automatically start working on these websites too , which would have been a great feature for power users. --- ## Post 8 by @pika — 2024-01-04T09:40:34Z > [@ph00lt0](#): > > You mention you stored a passkey on your yubikey for github. But does that allow you to login on android with it? you can now use yubikey on android to do passwordless logins by entering the pin. It works on github. it might be due to a some recent updates in play services. Though for some reason it doesn’t gives the option to use it over NFC but only by physicaly connecting it via the usb. ![Screenshot_20231230-182341](//forum-uploads.privacyguidesusercontent.com/original/2X/5/5df3a7ae97878c69023b1688fb67897fadf6bb76.png) --- ## Post 9 by @ph00lt0 — 2024-01-04T09:53:36Z Can you describe the steps you take to get here? That would be syper helpful. I have not been able to do this so far. --- ## Post 10 by @pika — 2024-01-04T10:01:34Z i didn’t do any particular steps , I am on Android 13 with latest play system updates (nov23) installed. It might have been enabled after the recent play system updates. After which i installed github app and tried to use passkey on yubikey and it gave me a pop-up to either use a “security key” or “this Device” . Also to be clear it only allowed me to login with the yubikey and still doesn’t allow registering new passkey with a yubikey. --- ## Post 11 by @pika — 2024-01-04T10:15:32Z > [@ph00lt0](#): > > N.b. this is not the same as using your phone as a security key. Same tech different implementation. I think google suggests in this [article](https://g.co/OnDeviceEncryption) that the passkeys that are stored in their password manager are encrypted by a key stored by the Android keystore system which can be unlocked only by your screen lock password. ![Screenshot_20240104-153802_1](//forum-uploads.privacyguidesusercontent.com/original/2X/c/c933437c8c3d4d32784168fd9c689a8b89f80f94.jpeg) --- ## Post 12 by @ph00lt0 — 2024-01-04T12:48:16Z well, this I only get when adding it as two factor. If you try to add a passkey, it prompts me to create on stored in the Google account on the phone. --- ## Post 13 by @pika — 2024-01-04T13:32:16Z > [@ph00lt0](#): > > prompts me to create on stored in the Google account on the phone. It will add the passkey to your google account in first step , but what my understanding from the pop-up was , they will encrypt that passkey with your local device password , while the passkey being synced to the cloud. Though still not 100% sure if its the case. --- ## Post 14 by @ph00lt0 — 2024-01-04T13:33:33Z Ah, well, so that’s not on the YubiKey then. Definitely not going to put any passkeys in google account. --- ## Post 15 by @abstract — 2024-01-07T09:06:34Z I can confirm that a Play Services update in September '23 added support for FIDO2 with PIN on security keys. It works really well in my testing on PixelOS. It, however, does not currently work on GrapheneOS. Unclear why. --- ## Post 16 by @ph00lt0 — 2024-01-07T12:15:48Z More on this: > **[Graphene OS 3rd party Passkey support on Android 14: Page 2 - GrapheneOS...](https://discuss.grapheneos.org/d/8184-graphene-os-lacks-3rd-party-passkey-support-on-android-14/22)** > > GrapheneOS discussion forum > **[Android 14: pin code with yubikey? - GrapheneOS Discussion Forum](https://discuss.grapheneos.org/d/5468-android-14-pin-code-with-yubikey)** > > GrapheneOS discussion forum --- ## Post 17 by @pika — 2024-01-07T15:36:12Z > [@abstract](#): > > It, however, does not currently work on GrapheneOS. Unclear why Its sad to see that google made passkeys a play services feature , rather than making it a part of the Aosp project itself as was thought by many initially. Also to note they still require a google for registering passkey and no option for using security key instead. --- ## Post 18 by @ph00lt0 — 2024-01-07T15:41:06Z > [@pika](#): > > Also to note they still require a google for registering passkey and no option for using security key instead. I think you are missing the point of the discussion once again. --- ## Post 19 by @pareto — 2024-03-22T19:34:32Z Fyi this screen is only shown the first time you use passkeys, i believe that the keys still sit in the secure elements, but are then synced to the cloud --- ## Post 20 by @anon54480285 — 2024-03-23T09:39:58Z As an alternative, you can create and store passkeys in something like Proton Pass. --- ## Post 21 by @ph00lt0 — 2024-03-23T13:14:26Z Yep now this works well. I have been testing this. Creation still doesn’t seem to work but using the ones saved earlier works well. --- ## Post 22 by @KeepItSimple — 2024-03-23T19:32:02Z > [@pareto](#): > > the keys still sit in the secure elements, but are then synced to the cloud I created maybe 20-30 passkeys, google password manager shows half of them only both in mobile and in web ui, the other half is not shown anywhere at all. There is no noticeable difference why, even different discourse boards have shown and hidden passkeys. Probably some option to show/hide set by service during passkey creation?