Comment by throwawayffffas
8 days ago
> at login time it's not possible to retroactively require attestation if it wasn't obtained during registration.
Of course it is, the site will reject the passkey and require you to create one that is attested.
> Are Netflix and Twitter currently requesting attestation when people register passkeys, and rejecting the registration if the user declines the permission prompt?
They could start tomorrow.
> a hypothetical and unlikely scenario.
You have not been paying attention, that scenario is where this whole thing is building towards.
> If consumer-facing sites start requesting attestation when registering passkeys, they deserve to be vigorously called out
It's going to be the banks first.
Why called out, it's all for your safety, to make sure you are not using an insecure client that might leak your data.
> It's going to be the banks first.
In Japan, this is already the reality. The FSA required brokerages to implement passkey authentication, and the effect is that it's no longer possible to have a brokerage account without a passkey. (Some brokerages, like Nomura Securities, will offer two separate client portals. The portal with money and trading-related functionality requires a passkey).
The thing that sucks a lot is that brokerages seem to also restrict the allowed software/hardware. Don't know the details, but none of my FIDO2 hardware keys were able to be used. I consistently use these hardware keys through WebAuthn, so I was surprised when my brokerage explicitly told me my hardware key is unsupported and I must use either Windows Hello or the iOS Passwords app.
The FSA's official explanation for mandating passkey implementation is that people kept falling for phishing attacks, and the attacks were getting too sophisticated thanks to "AI" or something.
> The thing that sucks a lot is that brokerages seem to also restrict the allowed software/hardware. Don't know the details, but none of my FIDO2 hardware keys were able to be used. I consistently use these hardware keys through WebAuthn, so I was surprised when my brokerage explicitly told me my hardware key is unsupported and I must use either Windows Hello or the iOS Passwords app.
Of course not, you still have some control over those FIDO2 hardware keys and they don't lock you to a limited set of devices. That's what the attestation is for, to allow banning the use of sign-in with anything but a couple megacorp providers. The few small time hangers on will be expelled in time. They're useful idiots for the adoption phase.
Notice that after lots of complaining about there being no way to transfer keys in the spec they developed some planned working group that will in the end only allow transferring from Google/Microsoft/Apple and maybe a few other dumpster companies. They aren't going to give that control up.
> The FSA's official explanation for mandating passkey implementation is that people kept falling for phishing attacks, and the attacks were getting too sophisticated thanks to "AI" or something.
Ah, yet another case of people being forced to use technology instead of being left alone doing things the old way where they understood all the risks.
> They could start tomorrow.
They could also start requiring you to mail a DNA sample to create an account tomorrow.
> It's going to be the banks first.
The same banks that (in the US) largely don’t even systematically use 2FA for online banking logins and completely ignore 3DS for card payments? Attestation usually requires customers to buy and carry extra hardware, so I highly doubt it.
The only place I’ve seen mandatory attestation is in enterprise IT, where admins can supply and enforce usage of e.g. Yubikeys.
Yes, the same banks that simultaneously don't support 2FA, or only support it via SMS, while insisting that mobile devices pass attestation. Also the same banks that still accept swiped credit card transactions but god forbid you want to register a custom non-attested device for wireless payment transactions. Those banks. Lets not pretend that the policies of US banks are by and large either internally consistent or in the customer's best interests.
Don't they support swiped credit card transactions because they can pass the increased cost of fraud onto merchants in the form of increased transaction and chargeback fees?
Are merchants obligated to accept swipe transactions?
Just go into r/Magisk, about 9 of 10 posts is a user whose banking app fails attestation.
Fuck banks with a cactus for forcing us to relinquish our freedoms as a precondition of interacting with them, which is a precondition to exist in most societies.
Sure, mobile device app attestation is a big problem for openness, but it has nothing to do with passkeys, where attestation is effectively dead for non-enterprise uses.
Arguably, even passkeys with attestation would be a step forward compared to that, as banks could require an external authenticator tap on a rooted device, or signature of some sandboxed secure element that runs independently from the application OS.
18 replies →
Fuck Play Integrity, which is what Google implements, with these drawbacks very much intentionally in place, and 'recommended' banks implement for security. Fuck Google for doing everything they can to make custom roms fail these API's ever more.
There is an alternative* of which I haven't heard in a while.
* https://uattest.net
2 replies →
On my GrapheneOS phone, the only things that I came across that require (and thus fail) maximum level attestation are Google Pay and the app for McDonald's for some reason.
1 reply →
Misplaced annoyance with the banks, they're responding to legislative pressures and incentives. Blame the regulators.
4 replies →
You answered your own question in parenthesis. US banks are an outlier and the US is not the entire world
Do you know a market in which banks widely use attestation for WebAuthN hardware authenticators?
Banks want attested terminals and for the customer to pay for them. An even better deal for the bank than ATMs, kind of like of how cable TV boxes enforce DRM on the customer and are paid for by the customer.
I've been menionting this a lot and it feels like no one is listening. These 3rd and 2nd party actors are expecting for you to pay for equipment for them. It's insane.
More context: I've been saying this a lot about this in the scan and go at sams club and how there are fanatics that act like it's a good thing and to be the only way to pay.
You'll pay for their security measures either way. Does it really matter that much if you see the line item charge or if it's baked into your interest rate spread?
1 reply →
Just gotta hope that based on how economic theory is supposed to work, if doing these things result in saving costs during procurement of specialized equipment, the savings are passed on to the consumer… hopefully…
1 reply →
The benefit of modern computers is that we can virtualize such an attested terminal without needing to have it be a separate device.
Great. Another place where passthru of a hardware dongle needs to be supported.
The banks are also a commonly mentioned reason to not use Grapheneos when it comes up on this site.
Attestation is already putting the screws onto open computing, and the frog is already on the boil.
Any site/service could easily implement their own proprietary solution to force compliance around usage of said service. Whether they can abuse Passkeys or not is irrelevant. If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.
To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater. All of these features of Passkeys are appropriate in a given context. The only concern is where a service that might not need/justify "high security" Passkeys starts demanding them anyway, and no-one is forcing you to use said service in that case.
> To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater.
Nah, it's fair to regard anything that supports remote attestation as toxic and aggressively thrust it into the biohazard waste incinerator. Any whiff of remote attestation, even being adjacent to it, and an angry mob should appear to burn your entire castle to the ground. Deters companies from wanting to be associated with it.
Also impedes the motte and bailey where they claim you can opt out of it until it's entrenched enough that you can't.
> no-one is forcing you to use said service in that case.
Until something with a monopoly or both halves of a duopoly or a strong network effect starts demanding it.
>> no-one is forcing you to use said service in that case
What remotely attested passkeys will really start being adopted for -- blocking consumer AI agent use.
Think about how many billable products are essentially convenience automation on top of a user's existing access in a platform?
What if consumers start using AI agents to interact with platforms in ways that skip those billing toll gates (because their agents are remixing actions / data on the user side)?
Both the intended (I'm skipping a premium charge) and unintended (I used a hacked agent and/or my agent went awry) are going to become major issues for companies in the next 5 years.
And the question will be asked "Can't we just ban user AI from using our app?"
Attested passkeys are going to be an awfully tempting option to reach for as an answer. Especially for banks. (Fuck banks' technology stacks)
What baby? Oh boy, a new authentication method just as secure as my unique per-site random password that I keep in my password manager already anyway, except I also completely lose access to it if I ever get locked out of my Google devices. The future is truly revolutionary.
Passkeys are stored in your password manager, too. You'll only lose access to your passkeys if Google is your password manager and you get locked out of your Google account. So, if you don't trust Google, use another password manager. (May I recommend Bitwarden?)
The advantage of passkeys is that no one can trick you into giving your passkeys to the wrong person. Every time this comes up, people say "I don't need that! I've got a password manager. I'm too smart to get tricked." But they are wrong.
2 replies →
I believe passkeys can be made phishing resistant, as they can be cryptographically bound to a given application, and the application has to attest itself to your system too.
You won't be able to use your google account passkey to log into the perfect clone of "gmail.com" where the 'a' is actually a greek or cyrillic letter or something, and neither will your ageing parents. You could still paste your password into the fake site from your password manager, or the spyware on your computer could still sniff it from your clipboard.
7 replies →
> If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.
Like how everyone stopped using Google/Gmail, Facebook/Instagram and Windows/Office365 and flocked to alternatives?
Let's flip your suggestion. What if someone says if you need "high security" build a competing service that enforces it, no one is forcing you to use a "low security" service ?
The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything.
My point was not about getting critical mass, it's that the service can already do anything they like to lock people into whatever they want and gatekeep their service. They can do it with Passkeys, or they can do it with a proprietary alternative and if they're big enough, they'll get away with it. Neither of us can sway them at all - I wasn't saying they should do this, only that they can.
Blaming Passkeys is aiming at the wrong target. Passkeys rightly offer features that have valid use-cases, even the attestation in the right context. Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not.
1 reply →
Any government can spy on a few people, and we're generally fine with that. But when they build a robust network of surveillance devices but pinky promise that they're only being used to spy on those same few people, we bring out the electric saws. It's a very similar situation with normalizing passkeys.
The concern you're raising here is that the government might secretly force big companies like Facebook or Google to require attested passkeys that restrict usage to only approved first-party keystores right?
Passkeys exist now and there's no taking them back. However, even if they did not, the government might well just develop its own authentication system and require that it be used under policies that require age verification for social media, for example. Hell, they might end up doing that anyway, and that would be no different. If the government wants to force tracking/verification on certain websites, it won't simply be something they walk away from if Passkeys don't exist. You can only fight this with your vote and by not using those services once they implement such controls.
2 replies →
I kind of agree, the problem is not individual sites consuming passkeys.
The main problem in my mind is on the side of the vendors, attestation, secure hardware, etc is all an excuse to lock you in to their device/ecosystem.
> It's going to be the banks first
This is a great point as banks already did exactly this and to me this seems like a very strong proof that we can't rely on "vigorously calling out"
So they're gonna stop supporting Apple users?
Nah, Apple is going to provide attestation, and since you can't or won't be able to share keys between accounts, no harm no foul.
Apple used to support attestation, but has removed it from recent iOS versions.
I really wish WebAuthN critics could finally update on this point. There is so much else to complain about, but nobody will listen to somebody regurgitating points stale by several years.
2 replies →
For a lot of people Apple is the ecosystem they access everything through, including payment processing. That cuts both ways, but Apple has shown a clear preference for protecting user privacy when they could have chosen to do otherwise, presumably because it makes them more money in the long run.
Why would that suddenly change in Netflix or some other company's favor at Apple's direct expense?
15 replies →
While not directly related to passkeys, CAs require private keys for code signing certificates to be generated on FIPS-certified hardware security devices, and use attestation to verify this.
I think OP was referring to “initial attestation”. Without that you cannot attest again.
We have more than enough technology in browsers to allow JavaScript reading live video from your webcam. A website could use that so they can see if you’re looking at the ads enough.
They could start doing it tomorrow. They just have to flip the switch.
What’s your point?