Comment by red_admiral
7 days ago
> Intended audience: non-technical citizens of the web
A good description of the design principles behind passkeys, actually.
> They can use passkeys to prevent you from running unapproved software.
Nope, that's attestation in general; passkeys are not required for that. Passkeys have nothing to do with secure boot, for example. Which version of manifest and adblock chrome/edge supports also has nothing to do with their passkey support. Nor does the possible mandatory age-verification flag we might soon get built into our phones: it'll definitely use some kind of crypto but that can still be one in other ways than with passkeys.
Passkeys are a kludge for many reasons, but let's be careful with our terminology.
>> They can use passkeys to prevent you from running unapproved software.
The expression was wrong, but the real meaning was described further in the post. The author meant that sites with passkeys can render unapproved software useless, in contrast to TOTP where any client is compatible.