Comment by josephcsible
7 days ago
Where is it required? If the answer is "nowhere before, but now that passkeys support it, places are starting to", then that's an argument that it's bad, not that it's good. And being able to "use the same passkey spec as everyone else without having to invent their own thing" is bad. I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.
> Where is it required?
Lots of places where you might have specific requirements about your authenticating users. E.g. to achieve FIPS compliance, or if your user population is low-single-digits because it's critical national infrastructure.
> I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.
I most definitely do not want operators of CNI to be "inventing their own" that can trivially allow compromise or weakness. "User freedom" is not the prevailing value in a lot of authentication contexts.
https://cphpost.dk/2026-10-10/news/round-up/123456-password-...