Dashlane Passkeys: Analysis of Sign-ups and Logins with Passkeys

TL;DR

• The article explores the growing trend of companies transitioning to passkey user experiences, this time focusing on Dashlane.
• Dashlane's passkey features, though early-stage, suggest a future of seamless cross-device / -platform synchronization
• The FIDO passkey standard, pushed by Apple, Microsoft, and Google, is facilitating this shift, allowing OS-level integration of password managemers.
• Dashlane's passkey features include an intuitive UI, visual login indicators, efficient rollout strategy, and an excellent conditional UI.
• Current areas for improvement include the lack of biometric authentication for password manager itself and absence of a feature to view or manage passkeys.
• The company is reportedly developing the solution which will be officially released in August 2023
• The analysis, conducted in July 2023, acknowledges that the situation is dynamic and subject to changes.

Introduction

More and more companies from a wide range of industries are stepping into a password-free world and implement passkeys. Through this series of articles, we aim to provide a comprehensive overview of the passkey user experience of those companies. This should enable you to incorporate these findings and enhance your product login accordingly. In each article, we focus on a single company.

Today, we dive into Dashlane. As we already pointed out in our article Will passkeys kill password managers a lot of password managers embrace passkeys and offer a passkey management. Even though in the official Dashlane changelog, passkeys are not specifically mentioned, we conducted early testing of Dashlanes passkey capabilities to compare them with other password managers like 1Password. The rollout of passkeys for password manager is a game- changing milestone on the way to a seamless cross-device usage and full synchronization between all platforms. Platform providers like Apple, Microsoft and Google fully support this approach. They incorporate the functionality of password management tools like Dashlane directly into their operating systems. This not only allows users to store passkeys in alternative locations beyond the platform's native storage features but also enables password managers to transmit their customers towards a password-free world.

Disclaimer :

1. Analysis conducted July 2023
2. Dashlane confirmed that they are actively working on the passkey solutions, so the article is subject to constant change. We will do our best to keep it updated.

Key insights from Dashlane analysis

Highlights of Dashlane passkeys implementation

1. Sophisticated User Interface:

One of Dashlane's defining features is its sophisticated user interface, which effectively utilizes pop-ups without creating interference with other browser tools. This feature provides a seamless and intuitive experience for users, enhancing the utility of passkey management.

2. Visual Indicators:

The Dashlane browser extension changes color from orange to green when the user is logged in, offering a visual cue that adds an extra layer of user- friendly functionality. This intuitive design element serves as a clear, immediate indicator of the user's login status.

3. Efficient Rollout Strategy:

Unlike competitors, who have released beta versions of their software, Dashlane rolled out their passkey support directly into the production version of their password manager in August 2022. This strategy may result in broader user adoption and passkeys can be introduced more seamlessly.

4. Excellent Conditional UI:

Dashlane offers a superb conditional UI, exhibiting no interference with Apple or Chrome's in-house tools like iCloud Keychain or Google Password Manager. Upon selecting an input field, previously created passkeys are suggested, freeing users from remembering not just their passwords, but also their signup credentials.

Drawbacks of the current Dashlane passkeys implementation

1. No Biometric Authentication:

Dashlane does not ask for biometric authentication if its password manager is opened at this point. This would simplify user access, eliminating the need to type in the master password ad the given occasion. However, the master password appears like a fallback option until credentials from platform- specific solutions (e.g. Windows Hello, Touch ID etc) or any other passkey provider is introduced within the next couple of months according to internal sources.

2. Absence of Passkey Overview/Management:

Dashlane does not offer a feature to view or manage passkeys. Even though it's purported to be implemented in Android 14, this could not be verified, creating a gap in the otherwise comprehensive management functionality. According to internal sources, passkey management will be rolled out in August / early September 2023. We are looking forward to providing an update for this.

Analysis of the login process

To make the analysis of Dashlane passkeys as comprehensive as possible, we tested the login process with several device-browser-combinations. We have recorded the outcomes in the following use cases. To better understand the use cases, please read through the conceptual definitions of passkeys below before jumping into the use cases.

Creation of passkeys vs. storage of passkeys: The creation of passkeys refers to the process of generating a passkey that provides access to specific accounts or services through biometric authentication. Dashlane only serves as a storage and management system for passkeys created by its users on different passkey-ready websites. The role of Dashlane is only to store and synchronize created passkeys across devices using its browser extension. By storing passkeys in Dashlane, users can access them on any desktop device with the Dashlane browser extension activated. To access the passkey stored in Dashlane, the user needs to log in to the Dashlane browser extension using the corresponding Dashlane account. For testing purposes and to compare the passkey mechanisms, we decided to utilize https://webauthn.io.

Tested cases

Note that we have only performed the use cases with passkey-ready devices (e.g., no iPhone prior to iOS 16.0, no MacBook prior to macOS Ventura, no Windows device prior to Windows 10). Also, for testing purposes, we used different services that support passkeys (e.g., passkeys.eu, WebAuthn.io, and Shopify) as well as different accounts.

Use case 1: Safari on MacBook

Delving into the realm of macOS Ventura, we aimed to test the application of passkeys on a MacBook, specifically with Safari. In macOS Sonoma though, it will be possible to use the system APIs from the Safari extension. As macOS Sonoma is currently only available in developer preview, we did not mention it any further throughout our analysis.

Upon downloading the Dashlane app from the App Store, it automatically launches, presenting Dashlane's array of currently implemented capabilities. However, to fully integrate and operate passkeys, the browser extension is indispensable for Safari, as it provides the vital autofill solution.

Dashlane application on MacBook

Dashlane does outline a process for establishing an alternative autofill solution within Safari. There have been some inconsistencies within the documentations of Dashlane depending on the respective language that we chose, but as of now, these inconsistencies seem to be resolved.

This process requires navigating to "Safari" in the menu, then selecting "Safari Extensions...".

Adding Dashlane extensions to Safari

Searching for Extensions leads you to Password AutoFill.

System settings on MacBook need to be adjusted

Upon opting for "Password AutoFill", we must select the checkbox for "Dashlane" to tell the OS, that we would like Dashlane to store our passkeys primarily.

Check "Dashlane" for Password AutoFill

Having installed the Dashlane application from the App store, we can finally get the Safari browser extension for the autofill functionality. Therefore, it is important to select the correct Dashlane version under Safari Settings Extensions, which is the early access version 6.2328.1 in our case.

Clicking on the logo, we log in with our Dashlane account that we created before. Currently, we rely on the master password to access Dashlane functionality of the extension.

Login mask of Safari extension

We are now prompted to allow notifications for Dashlane which we allowed in order to not interfere with the conditional UI.

Prompt to allow notifications

Now that the setup is completed, we test the passkey capabilities using WebAuthn.io. Since we switched the automatic password fill option in the system settings to Dashlane, we see the Dashlane icon within the text entry bar. The keychain beside the icon appears to be an Apple functionality but it has no relevance for our use case.

Passkey creation on Safari

Hitting Register we are prompted to save the passkey, that we created, into our Dashlane app. We are now completely relying on Dashlane as the provider and storage manager of passkeys. In previous versions, we got a popup from Apples Touch ID service asking to create the passkey. In the current early access version however, this is solved and we are fully utilizing Dashlanes potential.

Passkey creation successful

After confirming the request, we see that the conditional UI for Dashlane is working well within the Apple environment in contrast to 1Password. Here, we see only one overlay and it is giving a clean and coherent impression, also along other platforms (see below use cases).

Conditional UI working flawless on MacBook

Clicking on the passkey, that we created before, we can now access our passkeys. Also here, the conditional UI works with no limitations. The popup directly asks us about our identifier and the previously named passkey.

Confirm login via passkey

Confirming this finally logs us into our test venue, similar to other use cases.

Login via created passkey successful

Important to note is that these passkeys created on a MacBook using Safari are stored in the Dashlane account and can be accessed from any other browser and any other device. We tried to use the passkey on a Windows platform / Chrome browser and after signing into the Dashlane account, we could immediately use the passkey without problems.

Use case 2: Chrome on MacBook

The Dashlane extension for Chrome on MacBook is easy to install and use. Login requires a master password. The master password, however, is planned to be replaced by passkeys in the future. Passkeys created on WebAuthn.io are promptly stored by Dashlane, and login authentication runs smoothly. Interestingly, passkeys created on different OS devices are accessible on MacBook.

Installing the Dashlane browser extension for Chrome on a MacBook is a straightforward task. It can be easily done through the Chrome Web Store.

Upon successful installation, the Dashlane extension icon becomes visible in the browser's top right corner. The icon color changes according to the user's status: orange signifies a logged-out state, while a logged-in status turns it dark green.

Dashlane login mask in Chrome

Logging in to the Dashlane extension does not require any biometric authentication. Instead, we used a master password for an account. Again, it seems likely that this master password is replaced by passkeys along the way. Post-login, an email verification with an OTP was required, providing access to the browser extension. This access level was adequate for the use cases we sought to test.

Passkey creation MacBook Chrome

Our analysis continued with a visit to WebAuthn.io. We entered the text passkey "passkey_macChrome_test" and hit "register" to create a new passkey. The Dashlane extension promptly requested to store the newly generated passkey. Affirming the request resulted in the passkey being stored within the browser extension.

Confirm passkey creation on MacBook Chrome

The authentication process entailed hitting the "Authenticate" button on WebAuthn.io. As this was not our first passkey use on the site, we were asked to confirm the recently created passkey.

Select passkey for Login

Clicking confirm successfully authenticated us, thereby marking the successful completion of this use case test.

Login confirmation via passkeys on MacBook Chrome

Notably, the process was not interrupted by MacBook's in-house solution, iCloud Keychain. This may be attributed to our use of Chrome, as Chrome currently doesnt (yet) plug into iCloud Keychain which may change in the future. Previous tests (see use case 1) demonstrated that Safari currently lacks passkey support.

Successful login message

Additionally, we noted that passkeys created on another device with a different OS (in our case, Windows), like those in use cases 3-4, were also available on our MacBook. These passkeys appeared when clicking the small Dashlane symbol in the text field. This is a user-friendly feature, especially for users who don't wish to remember their login credentials (e.g., email address), reinforcing the utility and ease of passwordless authentication.

Cross-device passkeys displayed on login prompt

What we could also prove is that no matter what browser you use and log into your dashlane extension with the same account, passkeys are synced across devices and platforms and can be used for login with no troubles.

Use case 3: Chrome on Windows

Like use case 1 and 2 this test analyzes registering a passkey at WebAuthn.io. The account, labeled as "passkey_chrome_test", was to serve as a vital entity for our investigation, especially to understand the handling of passkeys across different browsers.

Following the registration, Dashlanes browser extension promptly initiated a popup, inquiring whether we intend to store the newly created passkey. Interestingly, the term "passkey" was explicitly used by Dashlane, reflecting its alignment with modern authentication terminologies.

Dashlane passkey creation confirmation notification

However, an intriguing observation was the absence of any request for biometric input, like fingerprint or facial recognition, typically via components such as Windows Hello. Instead, Dashlane relies on the master password mechanism, positioning it as the protective guard for the stored passkeys. As mentioned above the master password is likely to be replaced by passkeys in the future.

Upon affirming the storage of the passkey on Dashlane, a success message from WebAuthn.io confirmed that our "passkey_chrome_test" was fully operational. This marked the successful completion of the passkey registration phase.

For the authentication process, we re-visited WebAuthn.io, provided passkey_chrome_test as username and selected our recently created passkey for login. Upon hitting "confirm", the login process was completed successfully.

Passkey login confirmation

This successful execution further validated Dashlanes effective implementation of passkeys and provided valuable insight into the workings of passwordless authentication within password managers.

Upon registration of our passkey at WebAuthn.io, we noted that passkeys were not visible in Dashlane's browser plugin or website interface. Despite its practical function for login, the passkey remains unseen to users in the password manager. This introduces an interesting layer of opacity - users can't see or manage their passkeys. If they're unaware of their existence or can't access them, questions about security mechanisms and user control arise. However, it's worth considering that managing passkeys is being implemented as we speak. While we are currently in a testing phase, a final release is planned as of August 2023.

Releaseplan for Dashlane passkeys (Source: Dashlane.com)

We have not tested that on Android 14 yet, but we will provide an update after the final release by Dashlane early August 2023. But the development is worth tracking for further transparency.

Use case 4: Firefox on Windows

We decided to replicate our experiment using Firefox to observe any discrepancies. Just as before, we set out to use Dashlane's extension in conjunction with WebAuthn.io. Interestingly, we found the process to be rather similar but with one noticeable distinction.

When we signed into Firefox using the same Dashlane account, it immediately allowed us to login using the "passkey_chrome_test". The passkey was available even though we hadnt created it within Firefox, implying that the passkey had been synced across browsers within the Dashlane app, as it is synced between the Apple and Windows environment.

Following our exploration with Chrome, we decided to undertake a similar procedure with Firefox, emphasizing Dashlane and WebAuthn.io. The newly created passkey, "passkey_firefox_test", was registered at WebAuthn.io, replicating our prior steps.

Passkey creation on Firefox

In a familiar fashion, Dashlanes browser extension raised a query to store the new passkey. Dashlanes precise use of the term "passkey" stood out once again, indicating its readiness to adopt modern authentication systems.

Firefox passkey creation confirmation

One notable aspect remained consistent: the absence of a request for biometric input like fingerprint or facial recognition. Dashlane continues to put trust in its master password system, acting as the fortress for stored passkeys for now. In the future it seems likely to be replaced by biometric authentication as well.

Firefox passkey login confirmation

On confirming the storage of the passkey on Dashlane, we received a success message from WebAuthn.io. Our "passkey_firefox_test" was ready for action, marking the successful conclusion of the passkey registration process.

Successful passkey login message on Firefox

For the login process, we journeyed back to WebAuthn.io and opted for our newly crafted passkey. A quick tap on "confirm", and we found ourselves logged in, revalidating Dashlanes proficient handling of passkeys. This procedure confirmed our understanding of passwordless authentication within password managers, extending our knowledge across both Chrome and Firefox browsers.

Nonetheless, also on Firefox, it's noteworthy to speculate that the feature to manage passkeys might be currently under development. At the moment, we don't have access to an Android device operating on Android 14, leaving us unable to validate this hypothesis. Yet, this progress is worth keeping an eye on, especially for Firefox users seeking enhanced transparency in their passkey management.

Use case 5: Passkey management on Android 14

To be updated after August 2023 release of Dashlane passkey management.

Conclusion

Our ongoing examination of companies moving towards passkey user experiences zeroes in on Dashlane. This series aims to illuminate how different companies are incorporating passkeys. Dashlane has early-stage passkey capabilities, offering a glimpse of seamless cross-device use and synchronization. This shift, pushed by Apple, Microsoft, and Google, integrates password management tools into operating systems, allowing users more storage options for passkeys and enabling a move towards a password-free world. Highlights of Dashlane's passkey implementation include a user-friendly interface, visual login indicators, efficient rollout strategy, and excellent conditional UI. Yet, it currently lacks biometric authentication for the password manager itself and passkey management, shortcomings the company plans to address in the coming months.

Still to mention is that the passkey management is currently under heavy development and Dashlane will likely implement missing features such as the passkey management functionality. Nevertheless, Dashlane is an early adopter of passkeys along other password managers like 1Password. Especially UI and functionality will decide if this approach successful.