314
Passkeys may require some more research. (lemmy.zip)
submitted 3 weeks ago by to c/linux@lemmy.ml
122 comments fedilink hide all child comments
 

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 weeks ago* (1 child)

it is very possible an authority equivalent to Let’s Encrypt will come about

So why shouldn't we tell people to boycott the tech until then? Even then, that doesn't solve the threat of a hardware attestation toggle.

using a passkey is the equivalent of HTTPS’s TLS packets

I disagree.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 weeks ago

    why shouldn't we tell people to boycott the tech until then?

    because attestation the conspiracy to use attestation has not activated and i believe the damage is too small even if it did; i've argued how TPM reliance would be impossible for a very long time.

    that doesn't solve the threat of a hardware attestation toggle.

    just like how Let's Encrypt made acquiring certs (essentially a requirement for new websites now thanks to HTTPS, just like what you say passkey attestation is) extremely easy, the equivalent for passkeys would make new attestation providers quite easy, since the equivalent authority would be trusted

    I disagree.

    Why so? What about passkey attestation requires each user to issue a certificate?

  • permalink
  • fedilink
  • source
  • parent