It’s not MFA if all you need is your bitwarden password.

Unless your bitwarden has MFA and locks after an amount of time commensurate with your security needs

True, but how does GitHub know your bitwarden has MFA? It only knows something has a valid credential.

Github doesn’t need to know how you implement it, just that your browser is handling it (and in this case the browser lets Bitwarden handle it lol)

I don’t think that github has to know that. You could be using a password manager and choose to make it a minimum character boring password or meet minimum complexity requirements or use the same password on a million sites. You have to secure your credentials; complying with the minimums of a service isn’t security.

GitHub doesn’t need to know that - I think that’s why it’s a bit of a cop out for MFA. Sure, your bitwarden may implement MFA, but just a chrome browser isn’t MFA.

Passkeys enable sites to offload the responsibility of securing accounts to the user, and if the user chooses a weaker way to implement them, GitHub doesn’t give a fuck.

It technically is, it’s not about the amount of actions you need to do, it’s about the amount of actions the platform you are logging in needs to do with you. That both interactions interface with a bitwarden local device makes the weak link your local device, which already was anyway.

Github only asks me for (bitwarden’s) passkey. That’s just a single factor.

If you’re using software that properly uses your device’s SE / TPM chip then it’s much more secure against malware, etc. And the main selling point is the much stronger phishing resistance (can’t trick you into logging in via a fake site, etc)

A securely stored modern certificate is going to be magnitudes more secure than password plus MFA.

The certificate path uses cryptography to prevent disclosure of your secret, and can’t be compromised when the site inevitably gets hacked.

I wouldn’t classify passkeys as MFA tho, they are a passwordless method that’s more secure than most MFA methods. Afaik it’s based on signed certificates or something like that and that’s virtually unhackable unless someone gets physical access to your device (and that’s game over anyway).

But bitwarden uploads it to the cloud to be used on any computer, AFAIK.

Bitwarden uploads the whole vault (the whole json of passwords, passkey codes, MFA identifiers, credit card info…) encrypted with your master password. Meaning that whatever is on the cloud should be virtually unbreakable. That’s why every time you write the password in the extension or Android app or whatever it takes a second or two to open, because it’s downloading and decrypting everything locally.

When you update a password they need to reencrypt the whole vault and re-upload it again even though it’s wasteful since that’s their whole security plan.

This would be great if it worked consistently.

In reality, extensions work in some browsers but not others, on some websites but not others, and with passwords at least you can fall back to copying and pasting, or even typing, if auto-fill isn’t working in the context for whatever reason. With a passkey not only are you SOL, but it will delay your ability to move onto the password option if there is one.

The devils in the (implementation) details.

Agreed in general, but that’s how improvements roll out for anything basically.

You enable it where it works, and you keep using the nonce based MFA whose name I can’t recall right now for where it doesn’t work well.

It might sound annoying but that’s society, it takes a long time to adopt new tools and build a standard.