Comment by 1vuio0pswjnm7

"The post makes what appears to be one central claim: Passkeys support something called attestation, which lets a website ask for cryptographic proof of what made the passkey."

The Substack blog post focuses on "control", specifically the control that users might sacrifice by using passkeys:

"What's important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. "

"With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they're pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them."

https://fidoalliance.org/metadata/

"MDS acts as a global registry of passkey capabilities and equips your FIDO server with the intelligence needed to make data-driven decisions about which devices are allowed to access your systems."

Some users may be concerned about websites requiring them to use particular hardware and/or software

There is nothing inherently wrong with MDS

But it could be used to exclude users with "unacceptable" computers and/or "unacceptable" software

Will it. Who knows. That's not the point

"TOTP Is a Step Backwards"

"A passkey is bound to the domain it was created for, so your browser simply won't use your example.com passkey on examp1e.com. "

"This is the problem that passkeys solve."

This seems like a relatively small step; tradeoff for TOTP users seems worth it