Comment by growse
7 days ago
BigTech doesn't need attestations in the passkey spec to limit freedom.
Attestations were added so that highly specific domains where attestation is required (by law, a regulator etc.) can still use the same passkey spec as everyone else without having to invent their own thing.
If there was benefit to BigTech of locking in Auth to a specific device, they'd have done it long ago - it's not difficult.
Where is it required? If the answer is "nowhere before, but now that passkeys support it, places are starting to", then that's an argument that it's bad, not that it's good. And being able to "use the same passkey spec as everyone else without having to invent their own thing" is bad. I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.
> Where is it required?
Lots of places where you might have specific requirements about your authenticating users. E.g. to achieve FIPS compliance, or if your user population is low-single-digits because it's critical national infrastructure.
> I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.
I most definitely do not want operators of CNI to be "inventing their own" that can trivially allow compromise or weakness. "User freedom" is not the prevailing value in a lot of authentication contexts.
https://cphpost.dk/2026-10-10/news/round-up/123456-password-...