Comment by turtletontine

8 days ago

If you keep reading the article, you’ll see that the claim is current (unattested) passkeys are a stepping stone to “attested passkeys”. Attested passkeys would require remote attestation with OS, TPM, and password manager all working together, and would allow websites to require things like hardware backed non transferable passkeys that you don’t control. This has always been my suspicion and I do think it’s worth worrying about.

3 comments

turtletontine

Reply
shmerl  8 days ago

Sure, if they are actively pushing for that, it's bad. But otherwise passkeys are OK. It's a neat way to use private / public key pair instead of a dummy password.

  • tavavex  8 days ago

    This is already in the spec. It's not some faraway hypothetical, they could start requiring this tomorrow if they wanted to. And if you're capable of seeing any trends wrt the 'attestation' and 'securing' everything that are already here, you will know that all they're waiting for is for a significant enough portion of users to get passkeys on their platforms naturally, and then just force everyone else.