Comment by CSSer
7 days ago
I noticed that too. This also seems like a bit of an insult to the intelligence level of the average person. It’s precisely because attestation is a nuclear weapon that I doubt one of the big three will try it outside of their own specialized credentials. If someone tries to change ecosystems and finds that they’re going to have to reset all their passkeys it’s not going to take long for them to tell all their friends that passkeys suck and not to use them. This instantly kills adoption.
Furthermore, the rest of us are the people at the companies implementing passkeys. I did an implementation recently, didn’t require attestation, and can’t imagine why I ever would.
If we’re at this level of trust for all of FIDO, why aren’t we at legislative centers doing something much more dramatic about it instead of navel gazing about how we’re the smart ones who have recognized FIDO’s next big trick? How is attestation the problem here?
If the spec doesn’t guarantee portability, they’ll boil the frog to make sure you don’t get any.
> If someone tries to change ecosystems and finds that they’re going to have to reset all their passkeys it’s not going to take long for them to tell all their friends that passkeys suck and not to use them.
And their friends won’t care until they’re personally affected.