Comment by BoppreH

7 days ago

> Nothing about passkeys itself requires a hardware device or that the key be unexportable.

That's all true, but also not the point of this thread (offline backups) or the post (attestation limiting user freedom).

5 comments

BoppreH

Reply
mpyne  7 days ago

All of which have solutions in this thread too. Nothing forces you to use a passkey provider that enforces attestation if that’s what your threat model worries about.

  • BoppreH  7 days ago

    I admit that the 1+2 yubikey rotation mentioned elsewhere was clever and new to me, but I'd argue that none of the solutions in this thread were good enough.

    > Nothing forces you to use a passkey provider that enforces attestation if that’s what your threat model worries about.

    I'm very confused by this statement.

    For starters, attestation is unrelated to the topic of offline backups discussed in this thread.

    Second, the whole problem of attestation, as described in the original post, is that it's not you who decides when to use it. And it's not the passkey provider who enforces attestation, as you said. It's the Relying Party, like Netflix, who can unilaterally decide the minimum security features of my passkey scheme, with all their drawbacks, and attestation ensures that they're followed.

    • mpyne  7 days ago

      > It's the Relying Party, like Netflix

      So the problem, then, is with Netflix, not with passkeys. Breaking passkeys to try to prevent some different harm from befalling you does not make sense. And the passkey provider can enforce the lack of attestation by refusing to support it.

      Netflix could force you to use a chosen authentication provider to restrict that scenario. But, we already live in that world today, nothing in principle stops them from forcing you to use Okta Verify or Microsoft Authenticator in principle. Yet I do not see people using that as a reason to write articles about how OIDC 2.0 or TOTP is a trap.

      2 replies →