Comment by tantalor
5 days ago
That's a good thing?
Most consumer websites won't use attestation.
Places where additional security is required (bank, employer, etc) can.
5 days ago
That's a good thing?
Most consumer websites won't use attestation.
Places where additional security is required (bank, employer, etc) can.
Most consumer websites won't demand you share a scan of your face to third parties, until they do. Same exact thing will happen with passkeys, guaranteed.
Exactly how http was the standard for normal websites and banks et. al. using https until, everyone was.
Now that was a good thing with https, not so much with passkeys until Chrome pushes through a change and says they'll only accept attested passkeys issued by their own google password manager/authenticator.
Adding HTTPS everywhere was not "a good thing", it's coping with a civilizational coordination failure that shifted us to a lower trust equilibrium. We're paying the price for that in an endless update treadmill for clients and even for read-only webservers. And more compute-cycles and latency spent on the encryption handshake. We also lost caching HTTP proxies. This is bad actors creating a negative-sum outcome.
2 replies →
Access is a good thing too. I don’t want hardware attestation, i want to be able to access my bank from anywhere. Banks continually push their liability for security onto customers.
> Banks continually push their liability for security onto customers.
Bank customers: "You don't need to know anything about me."
Also bank customers: "You need to stop anyone who is not me from accessing my money."
People who are more tech libertarian don't like when critical aspects of their life requires a smart phone from either Apple or Google. The ability to avoid these companies is becoming increasingly difficult, and attestation is one piece of that puzzle.
I don't think that means throwing out passkeys entirely, but that's why you're seeing a lot of "slippery slope" stuff in here
Well those people can buy a YubiKey for $30 I guess. I don't see why that's a big issue.
Why do you think YubiKey would be an allowed option? Sites will require Google/Apple password manager and use this as a proxy to prevent bot accounts.
The line of thinking, I guess, is that you shouldn't be forced to buy a specific companies device just to access your own money. And in 10 years time, the companies approved to make devices like this will be DisneyAppleFlix and TeslOpenAI.
That's my guess, at least. I know next to nothing about attestation and passkeys.