Comment by NoidFonsense
5 days ago
This blog post is the perfect example of someone rationalizing away the bigger picture.
It's true that passkeys do not require hardware and OS attestation today, so all of the specific examples you cite are true. But the point remains that that passkeys can be EASILY extended to require hardware and OS attestation, and this will happen.
Banks have already done this. Before using an app was optional. Play protect was optional. It's like my uncle ted used to say, techonolgy is not optional.
When my state introduced seatbelt laws they assured the public that they would only be a secondary offense, never the primary basis for getting pulled over and issued a ticket.
Now they run "Officers are watching! Click it or ticket!" as an advertising campaign.
And I'm not arguing that seatbelt laws are bad per se, just that any time there is a pathway for more control, it will eventually be taken, even if assurances are made that it will not happen.
The arguments of they never "usually" do this, or "the guidance says" are meaningless. Whatever can be used for control, will be.
When you’re dealing with people so persistently stupid that they haven’t figured out the value of seatbelts, while still generally insisting that the costs of their medical care are socialized, my appreciation for the necessity of social control is enhanced rather than dampened.
When it comes to attestation, it's purely promoting business and state interests against yours. No security comes with it, it's purely control.
Imagine being the owner of a small business who is now required, to do business with any providers, to have a rogue executive that is loyal to them rather than you, and overrides your decisions; your provider refuses to sell you any materials if this executive is not obeyed. Do you think any business owner would accept that? I think on the contrary, this practice would be outlawed by Congress or the relevant legislative body in a matter of weeks. Those who voted seatbelts in. Then it's exactly that, if you replace business by computer.
1 reply →
The people are in control at all time, so I don't think this slippery slope argument is correct here (it's a logical fallacy for a reason).
You just have to remind the politicians from time to time - the French are a great example in that.
And every time you point it out, some useful idiot will say "you're making the slippery slope fallacy."
I think it's more that attestation can require a specific "approved" authenticator, and that authenticator is what would enforce all of the required OS/Software/Hardware requirements, even if it didn't get included in the attestation standard.
And passwords could easily be extended to requiring photo ID...
No, they can't. You could try ro replace passwords on your service with some stupid id verification scheme, but you have not extended passwords.
This is not true.
How? It wouldn't be easy at all it would be totally unconventional and break all sorts of expected workflows for passwords if you had to take a photo every time. For example at my work we have a ton of computers and none of them have webcams.
Passwords are client-neutral. Passkeys aren't: you can force a certain client, and now those clients can force an OS through attestation.
It happens now with 2fa today. I have gone through college for 4 years having to use this shitty duo mobile app and we have to take out our smartphones 20 times a day to do things and re-login after every 20 minutes.
and your bank can't force a certain client for a password if they decide to? or that you need to drink a confirmation can? or whatever arbitrary technical constraints they want to do in general?
anything can happen. if your passkey stops working because you're using it from your smart fridge to access your banking app, then just use your password anyway.
1 reply →
That's a good thing?
Most consumer websites won't use attestation.
Places where additional security is required (bank, employer, etc) can.
Most consumer websites won't demand you share a scan of your face to third parties, until they do. Same exact thing will happen with passkeys, guaranteed.
Exactly how http was the standard for normal websites and banks et. al. using https until, everyone was.
Now that was a good thing with https, not so much with passkeys until Chrome pushes through a change and says they'll only accept attested passkeys issued by their own google password manager/authenticator.
4 replies →
Access is a good thing too. I don’t want hardware attestation, i want to be able to access my bank from anywhere. Banks continually push their liability for security onto customers.
> Banks continually push their liability for security onto customers.
Bank customers: "You don't need to know anything about me."
Also bank customers: "You need to stop anyone who is not me from accessing my money."
People who are more tech libertarian don't like when critical aspects of their life requires a smart phone from either Apple or Google. The ability to avoid these companies is becoming increasingly difficult, and attestation is one piece of that puzzle.
I don't think that means throwing out passkeys entirely, but that's why you're seeing a lot of "slippery slope" stuff in here
Well those people can buy a YubiKey for $30 I guess. I don't see why that's a big issue.
2 replies →