Comment by AnthonyMouse
5 days ago
The objection here isn't to something that uses public keys instead of TOTP. It's that they added support for remote attestation to passkeys, which an enormous red flag and enables That Which Is To Be Prevented, i.e. permanently entrenching the incumbents because many third parties won't support new device makers with no user adoption yet and users won't adopt a device that won't work with many third party services.
Moreover, the large majority of ordinary people are going to use whatever comes with their phone anyway, which can then lock the key in the device's secure processor by default independent of remote attestation. So then it's not getting you anything for those people and the primary thing it does is to impede Linux Girl from using Linux and anyone new from ever trying to create a competing mobile platform or even a usable non-Google fork of Android.
The obvious way to satisfy people is to remove support for remote attestation from the spec.
> The obvious way to satisfy people is to remove support for remote attestation from the spec.
If you presume bad faith on the part of basically the entire WebAuthn implementer community, how does this help?
The consumer passkey authenticator implementations of today do not provide attestations, passkey relying parties do not consume them, and both would need to intentionally ship changes to enact the scenario you're worried about. If you're worried about both of these colluding to lock you out of your accounts, it seems naive to think that changes to an (intentionally malleable, extensible) spec will protect you.
Adding support for something to the spec implies that somebody is intending to do it, or why would they add it? This implies that someone is acting in bad faith (or openly promoting a malicious feature), and the best way for the others to show that they aren't in on it is to evict them from the room and strip out the thing they were trying to insert.
Taking it out doesn't mean you don't have to remain vigilant that they might try put it back, but what does it say if they're unwilling to take it out?
It's in the spec because enterprises use it for corporate authentication scenarios, where they do have legitimate reasons to restrict which kinds of authenticators their employees can use.
3 replies →
All the rest of this argument just misses me. Whatever the non-phishable authentication you want to use is, that's fine by me. But TOTP is phishable, eminently so, so you're not going to see security people back down from deprecating it.
Then they need to advance an alternative that doesn't support remote attestation.
I think the arguments about attestation are bogus for all the reasons everyone else is pointing out but that doesn't matter because I'm not talking about Passkeys, I'm talking about why TOTP is a dead letter. You're not going to get security people to back down on deprecating TOTP, because it's phishable, and the point of modern authentication protocols is defeat that attack.
By all means, keep lobbying against Passkeys! I don't care. But you'd be shooting yourself in the foot rhetorically to build TOTP into your case, as the comment I replied to originally just did.