Comment by JamesLeonis

> The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

Windows 11 rolled out with a required minimum TPM 2.0 as a way to force upgrade hardware, including threatening security updates. HN talked about it for weeks. It caused a mass exodus from Windows to SteamOS for many gamers.

While I agree this isn't a conspiracy, it is an open secret that these companies on the Alliance historically make and use standards to their own gain and against their users. It is the same with citizens relationship with governments, which comes with a long history of brutal repressions by the very agencies on the Alliance. This comes especially under the microscope when those tech companies collude with those Agencies against domestic citizens.

The trust is not there.

What's funny is that Passkeys are running into the OIDC problem again where everybody and their dog wants you to use their own implementation. The Costco app keeps bugging me to set up a passkey, and comments on the other HN thread have more examples [0]. It's just a mess. It's ironic the little inter-company territorial spats that keep the big conspiracies at bay.

On the other hand, I'm helping more people around me onboard into password managers. The number of accounts people have to juggle nowadays makes this a security mess too. Having one centralized place where all the accounts are stored (and backed up) is often a bigger boon for people than the secure passwords!

[0]: https://news.ycombinator.com/item?id=50048775