Comment by m-p-3
6 days ago
> locks you into a single vendor
You can allow multiple attestations GUIDs (AAGUIDs) if you want, you're not limited to the larger hardware providers (ie: Yubico).
So far the only place I encountered this is within our Microsoft Entra setup, where we have to option to allow all types of Passkeys (hardware-backed, cloud synced, non-attested, etc).
Also in some scenarios you might be required to limit the enrollment of Passkeys on hardware devices that are FIPS-compliant. Having a list of AAGUIDs to enforce this makes sense.
Who is "you" here? The person logging in (ie, the client), or the person providing the service (ie, a bank)?
I should have been clearer, you = person providing the service
I see. I believe the original "Passkeys are a trap" article was written from the point of view of the person logging into a service, who doesn't by themselves control enough market power to compel the service provider to support their preferred configuration of passkey. And thereby might find themselves forced to use an Android or iphone in order to access the normal infrastructure of society, such as banking or government services, when hardware-attestation passkeys become prevalent enough that, like Chrome, vendors can simply choose not to support alternatives.
I don't think they intended to make any argument that passkeys could be a trap to service providers.