Comment by AnthonyMouse
7 days ago
> To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater.
Nah, it's fair to regard anything that supports remote attestation as toxic and aggressively thrust it into the biohazard waste incinerator. Any whiff of remote attestation, even being adjacent to it, and an angry mob should appear to burn your entire castle to the ground. Deters companies from wanting to be associated with it.
Also impedes the motte and bailey where they claim you can opt out of it until it's entrenched enough that you can't.
> no-one is forcing you to use said service in that case.
Until something with a monopoly or both halves of a duopoly or a strong network effect starts demanding it.
>> no-one is forcing you to use said service in that case
What remotely attested passkeys will really start being adopted for -- blocking consumer AI agent use.
Think about how many billable products are essentially convenience automation on top of a user's existing access in a platform?
What if consumers start using AI agents to interact with platforms in ways that skip those billing toll gates (because their agents are remixing actions / data on the user side)?
Both the intended (I'm skipping a premium charge) and unintended (I used a hacked agent and/or my agent went awry) are going to become major issues for companies in the next 5 years.
And the question will be asked "Can't we just ban user AI from using our app?"
Attested passkeys are going to be an awfully tempting option to reach for as an answer. Especially for banks. (Fuck banks' technology stacks)