I agree the original post isn't great, but at its heart it's a rant about an unsolved problem: some applications need proof the key is kept secure, the only such proof FIDO provides is attestation, but in current solutions attestation is either absent or weak, or is strong but locks you into a single vendor.
Ricky is right the post is woolly, but if the principal software engineer at Apple's Authentication Experience team can't respond by telling us how they plan to solve the issue the post is about, it's an unconvincing rebuttal.
You can allow multiple attestations GUIDs (AAGUIDs) if you want, you're not limited to the larger hardware providers (ie: Yubico).
So far the only place I encountered this is within our Microsoft Entra setup, where we have to option to allow all types of Passkeys (hardware-backed, cloud synced, non-attested, etc).
Also in some scenarios you might be required to limit the enrollment of Passkeys on hardware devices that are FIPS-compliant. Having a list of AAGUIDs to enforce this makes sense.
Basically it boils down to “trust us, we won’t do what this guy is warning you we might do”
Forgive me, but that’s not convincing. The post even admits that it is entirely possible to do it. It just says that it will “antithetical“. Many antithetical things have been done in the past. It won’t be the first.
There was a member of the FIDO Consortium in a Keepass PR comment section implying that they would blacklist Keepass as a "responsible party" if they didn't remove sharing/export functionality that Google, Apple and others had at the same time.
These bodies need industry involvement/support (I've worked in similar WGs at both Red Hat and Microsoft), but it's very easy to engage in behavior that could easily be ladder-pulling.
Ricky Mondello is a principal software engineer at Apple, on the Authentication Experience team, and responsible for the Passwords app and developing the roadmap for passkeys.
I made a post on bsky about my distrust of passkeys and a person I've never interacted with showed up to argue with me in favor of passkeys.
They claimed to work on the implementation of passkeys and basically told me I was being paranoid.
But it's not paranoia when they're actually out to get you. No one else interacted with that post. It did not become viral in any measure. I'll never voluntarily use a passkey, and I'd rather use a different service or none at all rather than use one that forces me to use a passkey.
> The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.
Windows 11 rolled out with a required minimum TPM 2.0 as a way to force upgrade hardware, including threatening security updates. HN talked about it for weeks. It caused a mass exodus from Windows to SteamOS for many gamers.
While I agree this isn't a conspiracy, it is an open secret that these companies on the Alliance historically make and use standards to their own gain and against their users. It is the same with citizens relationship with governments, which comes with a long history of brutal repressions by the very agencies on the Alliance. This comes especially under the microscope when those tech companies collude with those Agencies against domestic citizens.
The trust is not there.
What's funny is that Passkeys are running into the OIDC problem again where everybody and their dog wants you to use their own implementation. The Costco app keeps bugging me to set up a passkey, and comments on the other HN thread have more examples [0]. It's just a mess. It's ironic the little inter-company territorial spats that keep the big conspiracies at bay.
On the other hand, I'm helping more people around me onboard into password managers. The number of accounts people have to juggle nowadays makes this a security mess too. Having one centralized place where all the accounts are stored (and backed up) is often a bigger boon for people than the secure passwords!
Not a great rebuttal.
I agree the original post isn't great, but at its heart it's a rant about an unsolved problem: some applications need proof the key is kept secure, the only such proof FIDO provides is attestation, but in current solutions attestation is either absent or weak, or is strong but locks you into a single vendor.
Ricky is right the post is woolly, but if the principal software engineer at Apple's Authentication Experience team can't respond by telling us how they plan to solve the issue the post is about, it's an unconvincing rebuttal.
> locks you into a single vendor
You can allow multiple attestations GUIDs (AAGUIDs) if you want, you're not limited to the larger hardware providers (ie: Yubico).
So far the only place I encountered this is within our Microsoft Entra setup, where we have to option to allow all types of Passkeys (hardware-backed, cloud synced, non-attested, etc).
Also in some scenarios you might be required to limit the enrollment of Passkeys on hardware devices that are FIPS-compliant. Having a list of AAGUIDs to enforce this makes sense.
Who is "you" here? The person logging in (ie, the client), or the person providing the service (ie, a bank)?
2 replies →
Basically it boils down to “trust us, we won’t do what this guy is warning you we might do”
Forgive me, but that’s not convincing. The post even admits that it is entirely possible to do it. It just says that it will “antithetical“. Many antithetical things have been done in the past. It won’t be the first.
No, the post in question just has really poor reasoning, and this one rightfully calls that out.
There was a member of the FIDO Consortium in a Keepass PR comment section implying that they would blacklist Keepass as a "responsible party" if they didn't remove sharing/export functionality that Google, Apple and others had at the same time.
These bodies need industry involvement/support (I've worked in similar WGs at both Red Hat and Microsoft), but it's very easy to engage in behavior that could easily be ladder-pulling.
5 replies →
Ricky Mondello is a principal software engineer at Apple, on the Authentication Experience team, and responsible for the Passwords app and developing the roadmap for passkeys.
https://rmondello.com/rmondello-résumé.pdf
I made a post on bsky about my distrust of passkeys and a person I've never interacted with showed up to argue with me in favor of passkeys.
They claimed to work on the implementation of passkeys and basically told me I was being paranoid.
But it's not paranoia when they're actually out to get you. No one else interacted with that post. It did not become viral in any measure. I'll never voluntarily use a passkey, and I'd rather use a different service or none at all rather than use one that forces me to use a passkey.
> The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.
Windows 11 rolled out with a required minimum TPM 2.0 as a way to force upgrade hardware, including threatening security updates. HN talked about it for weeks. It caused a mass exodus from Windows to SteamOS for many gamers.
While I agree this isn't a conspiracy, it is an open secret that these companies on the Alliance historically make and use standards to their own gain and against their users. It is the same with citizens relationship with governments, which comes with a long history of brutal repressions by the very agencies on the Alliance. This comes especially under the microscope when those tech companies collude with those Agencies against domestic citizens.
The trust is not there.
What's funny is that Passkeys are running into the OIDC problem again where everybody and their dog wants you to use their own implementation. The Costco app keeps bugging me to set up a passkey, and comments on the other HN thread have more examples [0]. It's just a mess. It's ironic the little inter-company territorial spats that keep the big conspiracies at bay.
On the other hand, I'm helping more people around me onboard into password managers. The number of accounts people have to juggle nowadays makes this a security mess too. Having one centralized place where all the accounts are stored (and backed up) is often a bigger boon for people than the secure passwords!
[0]: https://news.ycombinator.com/item?id=50048775
Great rebuttal.