Comment by dmitrygr

7 days ago

Basically it boils down to “trust us, we won’t do what this guy is warning you we might do”

Forgive me, but that’s not convincing. The post even admits that it is entirely possible to do it. It just says that it will “antithetical“. Many antithetical things have been done in the past. It won’t be the first.

7 comments

dmitrygr

Reply
lxgr  7 days ago

No, the post in question just has really poor reasoning, and this one rightfully calls that out.

  • FireBeyond  7 days ago

    There was a member of the FIDO Consortium in a Keepass PR comment section implying that they would blacklist Keepass as a "responsible party" if they didn't remove sharing/export functionality that Google, Apple and others had at the same time.

    These bodies need industry involvement/support (I've worked in similar WGs at both Red Hat and Microsoft), but it's very easy to engage in behavior that could easily be ladder-pulling.

    • jesseendahl  7 days ago

      >if they didn't remove sharing/export functionality that Google, Apple and others had at the same time.

      This is factually incorrect — no one supported exporting passkeys at the time and I believe the only ones who supported passkey sharing of any kind was Apple: https://support.apple.com/guide/iphone/share-passwords-iphe6...

      What that Keepass X GitHub PR comment section was discussing was giving users a way to export their passkeys to an unencrypted file on disk, which would have allowed for attackers to convince non-technical users to export all their passkeys and then send them to an attacker.

      I believe person who commented on that GitHub PR was trying to explain that instead of implementing export to plaintext file on disk, it would be a better idea to implement the Credential Exchange Protocol, which was almost finished at the time.

      https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20240522.html

      Fast forward to today... and it looks like there's movement towards doing exactly that:

      https://github.com/keepassxreboot/keepassxc/pull/13343

      --

      Edit: Indeed if you scroll down to the last comment on that infamous PR (https://github.com/keepassxreboot/keepassxc/issues/10407#iss...), you'll see they closed it in favor of implementing the Credentials Exchange standard.

      1 reply →

    • lxgr  6 days ago

      That's not a fair reading of that comment, in my view (assuming you mean https://github.com/keepassxreboot/keepassxc/issues/10407#iss...).

      I read it as "your actions might push relying parties to use attestation to be able to block you", not as "we, the FIDO consortium will block you". (How could they? There's no signer identity to block without attestation!)

      That said I don't agree with the substance of the comment; it's effectively an appeal to security by obscurity/unavailability of user-friendly insecure export methods.