Comment by mixdup
5 days ago
Google would not do something that would lock out half of the mobile device market. iOS doesn't do attestation.
Also, is there a reason Thunderbird or other clients couldn't use OAuth? I'm fairly certain I can login to GMail on Mail.app in macOS and other clients, so they're not using that to lock people into the official app or their browser
Are you sure iOS doesn't do attestation? Google recently turned on requiring an iOS or Google-attested Android device with a camera for some reCAPTCHA challenges(i.e. take a photo of this QR code). They waited for Apple to support it before doing so.
Is that the same thing we're talking about here? That sounds like a CAPTCHA, not Passkeys. I mean iOS isn't doing attestation in Passkeys, I'm sure there's some thing on the phone that it's doing that is a version of attestation
Thunderbird is an email client, not a web browser or a web server. It had to build in support for both of those things to support oauth2 login: https://bugzilla.mozilla.org/show_bug.cgi?id=849540
I assume Mail.app had to do the same.
Okay? At some point mail applications didn't support IMAP, because it was new. Was IMAP bad because it forced POP3 clients to build new support that they didn't previously do in order to support the improved functionality?
OAuth wasn't about lock-in (since any client can support it), it was about getting off shitty legacy auth
OAuth2 solves a bunch of problems that are irrelevant for a desktop email client. https://news.ycombinator.com/item?id=50089261
You shouldn't need a web browser to read email.
Google today might not do that, but Google tomorrow, when some upper manager's multi-million dollar bonus gets tied by a performance metric on how many people are using passkeys for gmail would in a heartbeat.