Comment by raphting
7 days ago
Advocating for privacy and at the same time speaking about "corporations like Microsoft, Google, Apple, Facebook, Amazon" is a contradiction for me.
Have all your mails at Google, ship stuff home with Amazon, but your authentication mechanism is a trap and anti-privacy?
My company's product uses passkeys-only and it works great. We don't need to store user's email addresses if they don't want to. Because we don't need a password-reset flow. Because passkeys usually sync and backup. And if you really want, you can have multiple passkeys for your account (or multiple accounts).
I don't see how we could use passkeys as a trap. Our users find it convenient and the security properties speak for themselves.
> Because passkeys usually sync and backup
And when they don't? What then?
One of the biggest issues with the implementation of passkeys that I've encountered is that I'm not offered the choice of where a passkey will be stored. It's just a fight between my password manager, my browser and my OS which all try to be "first" to intercept the passkey request, and if the "wrong one" gets it there's no way to say "actually no, I didn't want you to handle this passkey request".
> It's just a fight between my password manager, my browser and my OS which all try to be "first" to intercept the passkey request, and if the "wrong one" gets it there's no way to say "actually no, I didn't want you to handle this passkey request".
This is one of my biggest issues. My family full of normal people are nothing more than dark pattern victims. And if you teach them to avoid certain dark patterns, big tech is quick to update them.
The whole industry is turning into one big scam.
The author is clearly saying that the attestation feature is a trap. Typical consumer-oriented websites don’t use this feature. Therefore it is not a trap for your users. However there is no way for users to know and understand that.
No browser or consumer password manager implements attestation. There's no need for users to know something that's simply not relevant for them.
Then remove it from the spec and everyone is happy. I don't trust big tech companies to not use this feature if it is available. They have too much incentive to be the sole gatekeeper for your ability to log in to services.
1 reply →
Not if fear-mongering articles like this become widely circulated and make people believe attestation is widely used.
I dread the day my mom encounters a web app that only allows passkeys. She gets passwords, and importantly, the ability to log in from any PC just by knowing her password (which, yes, is written in a little notebook, baby steps). If she wants to log into her account on some shared PC, she understands that flow, the password is a key that is synced through her typing it in.
If I have to explain Passkeys syncing from her PC where she made the account, to her phone, then to the 3rd PC using some qr code or bluetooth, then we're both gonna lose it. There is value in passkeys, but there's also huge value in a stupid and slightly less secure password that we've just completely abandoned.