Comment by somerandom2407
8 days ago
Any site/service could easily implement their own proprietary solution to force compliance around usage of said service. Whether they can abuse Passkeys or not is irrelevant. If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.
To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater. All of these features of Passkeys are appropriate in a given context. The only concern is where a service that might not need/justify "high security" Passkeys starts demanding them anyway, and no-one is forcing you to use said service in that case.
> To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater.
Nah, it's fair to regard anything that supports remote attestation as toxic and aggressively thrust it into the biohazard waste incinerator. Any whiff of remote attestation, even being adjacent to it, and an angry mob should appear to burn your entire castle to the ground. Deters companies from wanting to be associated with it.
Also impedes the motte and bailey where they claim you can opt out of it until it's entrenched enough that you can't.
> no-one is forcing you to use said service in that case.
Until something with a monopoly or both halves of a duopoly or a strong network effect starts demanding it.
>> no-one is forcing you to use said service in that case
What remotely attested passkeys will really start being adopted for -- blocking consumer AI agent use.
Think about how many billable products are essentially convenience automation on top of a user's existing access in a platform?
What if consumers start using AI agents to interact with platforms in ways that skip those billing toll gates (because their agents are remixing actions / data on the user side)?
Both the intended (I'm skipping a premium charge) and unintended (I used a hacked agent and/or my agent went awry) are going to become major issues for companies in the next 5 years.
And the question will be asked "Can't we just ban user AI from using our app?"
Attested passkeys are going to be an awfully tempting option to reach for as an answer. Especially for banks. (Fuck banks' technology stacks)
What baby? Oh boy, a new authentication method just as secure as my unique per-site random password that I keep in my password manager already anyway, except I also completely lose access to it if I ever get locked out of my Google devices. The future is truly revolutionary.
Passkeys are stored in your password manager, too. You'll only lose access to your passkeys if Google is your password manager and you get locked out of your Google account. So, if you don't trust Google, use another password manager. (May I recommend Bitwarden?)
The advantage of passkeys is that no one can trick you into giving your passkeys to the wrong person. Every time this comes up, people say "I don't need that! I've got a password manager. I'm too smart to get tricked." But they are wrong.
The concern is that the site you're logging into can tell the difference between a passkey created by Google on a (recent, non-rooted, locked bootloader) Android device using its cryptoprocessor, and a passkey created by Bitwarden which you can sync/backup as you like. And Google, Apple & Microsoft are well positioned to encourage people towards the former over the latter.
The possibility that sites will require attested keys does seem pretty remote at the moment, but if passkeys take off and >95% of people use keys tied to their phone, I could totally see sites starting to prevent you using a key from Bitwarden. I don't think there's a conspiracy trying to achieve this, but the incentives of security & lock-in could push us there.
1 reply →
I believe passkeys can be made phishing resistant, as they can be cryptographically bound to a given application, and the application has to attest itself to your system too.
You won't be able to use your google account passkey to log into the perfect clone of "gmail.com" where the 'a' is actually a greek or cyrillic letter or something, and neither will your ageing parents. You could still paste your password into the fake site from your password manager, or the spyware on your computer could still sniff it from your clipboard.
Password managers check the domain before they fill.
6 replies →
> If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.
Like how everyone stopped using Google/Gmail, Facebook/Instagram and Windows/Office365 and flocked to alternatives?
Let's flip your suggestion. What if someone says if you need "high security" build a competing service that enforces it, no one is forcing you to use a "low security" service ?
The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything.
My point was not about getting critical mass, it's that the service can already do anything they like to lock people into whatever they want and gatekeep their service. They can do it with Passkeys, or they can do it with a proprietary alternative and if they're big enough, they'll get away with it. Neither of us can sway them at all - I wasn't saying they should do this, only that they can.
Blaming Passkeys is aiming at the wrong target. Passkeys rightly offer features that have valid use-cases, even the attestation in the right context. Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not.
> Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not.
Let the usecases that need passkeys use it.
Why can't there be a parallel standard with similar features that doesn't have the parts that can potentially be abused. If the difference between abuse and non-abuse is a vague promise and the good graces of corporate structures, it is better to err on the side of caution and demand solutions that make it impossible.
> The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything.
Yeah it wasn't your place or anyone else's. How can you or I force anyone. Not sure why that even came up.
Debate is how we evolve new and alternate solutions. Handwaving by saying not your place or mine is not how we affect change if needed.
Any government can spy on a few people, and we're generally fine with that. But when they build a robust network of surveillance devices but pinky promise that they're only being used to spy on those same few people, we bring out the electric saws. It's a very similar situation with normalizing passkeys.
The concern you're raising here is that the government might secretly force big companies like Facebook or Google to require attested passkeys that restrict usage to only approved first-party keystores right?
Passkeys exist now and there's no taking them back. However, even if they did not, the government might well just develop its own authentication system and require that it be used under policies that require age verification for social media, for example. Hell, they might end up doing that anyway, and that would be no different. If the government wants to force tracking/verification on certain websites, it won't simply be something they walk away from if Passkeys don't exist. You can only fight this with your vote and by not using those services once they implement such controls.
> Passkeys exist now and there's no taking them back.
I mean, we can take them back. Everybody refuse to use them and cause as much trouble as possible for anyone who tries to make you. Use TOTP or similar instead.
> If the government wants to force tracking/verification on certain websites, it won't simply be something they walk away from if Passkeys don't exist.
The way you fight things like this is by making it so the current technology is incapable of doing it and then if they try to legislate it, you have more time to roll back the policy before the technology to support it can be developed and imposed on everyone.
Implementing support for the dystopian technology before the law even requires it is the opposite of that.
Id.me tells peasant to record a video and like it.
I kind of agree, the problem is not individual sites consuming passkeys.
The main problem in my mind is on the side of the vendors, attestation, secure hardware, etc is all an excuse to lock you in to their device/ecosystem.