Comment by apexalpha
5 days ago
I introduced Passkeys in my company.
Every single IT person thought it would be an extreme mess, too complicated for regular users. In my company we work on the (gas) grid so lot's of blue collar types.
We went there, gave the pilot group a Yubikey and said: This is like the company pass you already have. Without the company pass you cannot enter any buildings. Without the Passkey you cannot enter a computer or app.
If you lose it report to the same people (service desk).
The response has been EXTREMELY POSITIVE. People fucking LOVE getting rid of passwords, password requirements and taking off their gloves to enter it every time.
We are now rolling it out to everyone and next year when we stop our silly "phishing game" contract we will actually save money while reducing a massive cyber security risk for our company: (voice) phishing.
> If you lose it report to the same people (service desk).
THIS is the reason it worked great for your use case. You have a stopgap for the worst case.
You also have a limited, well-known, and mandated set of compatible software and hardware. And you don't have to worry about attestation preventing you from using any future hardware or software, because you have control over any attestation whitelists.
The scenario people worry about is not "passkeys being mandated by your company to access company webapps on company-provided devices, with easy access to in-person passkey resets". The scenario people worry about is passkeys making them lose access to third-party sites on their own devices.
I think my use case covers >99% of all organisations.
Perfectly fine in a business environment where you don't have privacy. It is unacceptable for any personal computer(including phones) to be leaking unique ids so you can be tracked.
What's the unique id leaking issue?
I mean you're logging in to some software, surely they need some info from you?
Passkey attestation hands control of the client software to the website. Since surveillance capitalism funds most of the web, this means that, over time, the only approved clients will be surveillance devices, and those devices will slowly add more and more invasive spyware.
Initially, they will probably “just” require hardware serial numbers or similar (so they can join IDs on the backend).
There are already serious proposals to require live web cam feeds for porn site login biometrics purposes, so I can’t really come up with any hyperbole to add.
1 reply →
They need you to prove you have the private key. They don't need to know what kind of phone you're using etc.
Don't Yubikeys long predate the passkeys standard?