Comment by jeroenhd

Passkeys work on every Linux device I've used. Maybe the BSDs are missing support but there aren't any FOSS issues here.

This panic about "but what if attestation" goes for any standard that people on open source platforms use. What if browsers add attestation? You're only one update away from losing your freedom! Browsers are a conspiracy by big tech! Apple already built remote attestation into Safari under the Private Access Token system, after all.

There is no intent to kill FOSS, not even from Microsoft anymore. The reality is much worse: nobody really cares about FOSS, except for the parts that make money. No big tech CEO is wringing their hands thinking of ways to end freedom once and for all. They just don't care if whatever they do doesn't work on Linux.

Companies like Disney are happy to block any Linux computer already with the standards we have. Not because they hate freedom, but because they don't care their DRM doesn't work.

Attested passkeys, on the other hand, are a massive pain. You'd need to get a list of all the keys for all the normal trusted parties (Google/Microsoft, Apple doesn't even support it, Yubikey, and so on) and keep that list up to date. The moment a model of Yubikey gets a firmware bug published, all keys signed by all Yubikeys of that firmware need to be retracted (and all users locked out) or attestation is meaningless. They're way too much work outside of the space they're actually useful: managed hardware for employees, where the user has already given up any control anyway.

TOTP is not an alternative for passkeys. It's trivial to phish and it does get phished all the time. The only comparable authentication mechanism is client certificates/mTLS, which has been tried and dismissed long ago.