Comment by marcosdumay
5 days ago
It was about forbidding members from syncing with any software that allows or can be altered to allow plaintext exports.
5 days ago
It was about forbidding members from syncing with any software that allows or can be altered to allow plaintext exports.
From one guy mad in a github thread. It's a nothingburger.
The fact that they are reserving the right to say what software I can export my keys to makes every rumor a real-burguer. Even if this one specific case turns out to not be real.
"They". Again, it was one guy, who didn't have the full backing of his employer much "the FIDO group". Who made a suggestion, though it was written as a threat because he was bad at communication.
Not to mention the only way to blacklist a specific app from Passkeys is to use the AAGUID from attestation which means it only applies to attestation. A few pieces of software were providing AAGUIDs by choice even when not attested and Apple helped remind them that the spec says non-attested Passkeys should always just return an Empty UUID (all zeroes) in AAGUID. The people that are going to block non-attested Passkeys might as well block all of them, including Apple consumer Passkeys.