Unable to sign into Yahoo using a passkey

johnnygoodface

1Password says "passkey available" on my Yahoo card, but it's not! Instead they use a Yahoo dedicated "Account Key" instead. So why show this message?

---

_1Password Version: 1Password for Mac 8.10.9 (81009029)
_Extension Version: 2.13.1
_OS Version: 13.4.1
_Browser: Safari

GreyM1P

Hi there @johnnygoodface

There is an entry for Yahoo! on our https://passkeys.directory website:

☞ https://passkeys.directory/details/yahoo/

As noted in its listing there, you might need to remove any authenticator apps you have set up for Yahoo! before you'll be able to save a passkey. Give that a try if you haven't already and let me know if following the link on the Passkeys.directory listing helps too. :)

— Grey

johnnygoodface

I've turned off the Account Key, and now it only offers those choices when I turn on 2-step verification:

So clearly Yahoo doesn't offer passkeys yet (at least in Canada)

mikesilva

Security Key = Passkey, though in this case Yahoo may only allow you to use it for 2FA, rather than an authenticator app, instead of completely handling login. I seem to remember, however, being able to sign in with a passkey alone, once I removed my authenticator app 2FA.

Not all sites have upgraded to allow Security Keys/Passkeys for complete 1 step login. However, even on those you can still create a security key, which 1Password will store as a Passkey, and eliminate having to fill an auth key. Presumably, if they aren't knuckle heads about it, once a site enables 1 step passkey login, the passkey you setup via their security key option will 'just work'.

johnnygoodface

Sorry to contradict you but Security Key is not a Passkey. Security key is a physical key you insert like a USB Yubikey key and you would then follow Yahoo's instructions like this:

Passkey is software only and doesn't require any physical device.
I've fully disabled my 2FA and started over again but Yahoo still only offers those 3 options above, and none of it is Passkey.

I guess the correct question is: "why is Yahoo listed in the Passkey directory (https://passkeys.directory/details/yahoo/)?" because this is probably why 1Password is tricked into thinking Passkey is available for Yahoo.

ag_tommy

@johnnygoodface

I ran into the same issue you described. I'll get this mentioned to the team.

edit: It looks like it might be in a beta or something like that. https://in.help.yahoo.com/kb/SLN35635.html

mikesilva

I know what a physical security key is, but Passkey is quite literally the same thing in software. They both implement the FIDO authentication standard. Ergo, Passkey can be used as a second factor, if that's all the site allows, no matter what the site's slow to get a clue administrators call it.

Therefore, there is no error with 1Password's alert that Passkey support is available. In the Passkey directory that 1Password maintains, there may need to be an edit done to specify whether they support both Signing and MFA, or just MFA.

MinhThienDX

@johnnygoodface You can use passkey instead of a physical key, 1Password enabled that.
When the Yahoo website prompt for physical key, an 1Password popup will appear.
I enabled passkey using Security Key option.

Only for 2-Step Verification though.

I think they should update https://passkeys.directory since I can't login using passkey.

johnnygoodface

Wow that's one weird method Yahoo's using!! Indeed you're right: with them when you setup a Physical Security Key (you don't have a choice, they don't list "passkey" anywhere as a security method), it creates a Software Passkey, and of course 1Password will store it as a passkey. The problem with that confusing approach is:

1. Passkey should NOT rely on a physical key, as it's the case here
2. Their method is not standard and will mix up people (in my opinion they already are)
   At least it allow us to name the key, so it'll be easier if Yahoo ask for the physical key in the future (cause I use 3 keys)

One weird fact though: the key I inserted has a finger reader (NOT a fingerprint reader), and on every other site asking me for a key, I had to press my finger on the key to validate I'm there, but not this time. It accepted the key right away!

Yahoo, you're weird guys!!

johnnygoodface

I confirm that Yahoo ask for a physical key (at least in their picture), but in reality it must be asking for the passkey cause 1Password kicks in and suggests the saved passkey.

WGBeekhuis

Also in The Netherlands Yahoo doesn’t support Passkeys. I tried several times to check if it should be available, but unfortunately Yahoo has no t taken steps to implement Passkeys.

ngoodall

This is confusing. Yahoo doesn't allow passkeys. I'm not too interested in, "well technically they do..."

WGBeekhuis

I think because Yahoo.JP (Japan) was one of the first companies who supported Passkeys, Yahoo was recognized to take place on the list of supported Passkeys sites.
U fortunately other Yahoo countries dit not follow this innovating initiative.
See also https://web.dev/case-studies/yahoo-japan-passkeys

Dave_1P

Hello everyone,

Passkeys.directory now shows that Yahoo.com supports both Sign in with passkey and Passkey MFA. Please see our entry for more details: Yahoo.com - Passkeys.directory

If you don't see the option to add a passkey then it may not yet be available for your Yahoo account, it looks like Yahoo is performing a staged rollout. If Yahoo does make passkeys available for your account then 1Password will be ready to save and sign in using that passkey.

@WGBeekhuis

According to passkeys.directory, currently only Yahoo.com and Yahoo.co.jp have introduced passkey support.

-Dave