314
Passkeys may require some more research. (lemmy.zip)
submitted 3 weeks ago by to c/linux@lemmy.ml
122 comments fedilink hide all child comments
 

you are viewing a single comment's thread
view the rest of the comments
[–] 46 points 3 weeks ago (9 children)

Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 33 points 3 weeks ago*

    I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.

    At this point in time it's not a problem, but how can we know it won't be in future?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 25 points 3 weeks ago* (5 children)

    This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 31 points 3 weeks ago (3 children)

    The argument from the "it's a trap" article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.

    I have to admit that I haven't investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 11 points 3 weeks ago (1 child)

    The web api for fido2/passkeys exposes attestation information.

    Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.

    from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 10 points 3 weeks ago*

    Mozilla's warning is funny. "Don't use this to reject attestations from unapproved authenticators!" That's, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?

  • permalink
  • fedilink
  • source
  • parent