This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.
Until they only allow specific AAGUIDs to enroll passkeys that don’t include the one used by KeePassXC (fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don’t consider them secure enough.
Me personally, I’d get a burner smartphone in a drawer just for banking that is on airplane mode 24/7 except when I need it for banking and use a dumbphone for everything else. Also, I run linux and I have strict control over my router and I have ZERO subscriptions and creditcards. It’s not much but it’s something. Beats blindly rimming apple and alphabet.
The argument from the “it’s a trap” article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.
I have to admit that I haven’t investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.
The web api for fido2/passkeys exposes attestation information.
Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.
Mozilla’s warning is funny. “Don’t use this to reject attestations from unapproved authenticators!” That’s, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it’s not a problem, but how can we know it won’t be in future?
This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.
Until they only allow specific AAGUIDs to enroll passkeys that don’t include the one used by KeePassXC (
fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don’t consider them secure enough.https://aaguid.nicolasuter.ch/
For now.
In some countries, banks require users use their app on IOS or Google’d Android. You can’t use their services via browser, LineageOS, GrapheneOS
True. I’m kind of affected by this in GOS, although I found a workaround to bludgeon my banking app into submission.
Still, this is an issue that is already here, and it exists independently of passkeys.
Then you’re screwed anyway
This mentality is so gross. “Well might as well roll over and get pounded in the A by big corpo! what else am I going to do, right? Hehe!”
So what are you gonna do about i
Me personally, I’d get a burner smartphone in a drawer just for banking that is on airplane mode 24/7 except when I need it for banking and use a dumbphone for everything else. Also, I run linux and I have strict control over my router and I have ZERO subscriptions and creditcards. It’s not much but it’s something. Beats blindly rimming apple and alphabet.
That’s not gonna stop them from doing any of these things you’re afraid of it’s just sparing you from it
Fuck off with that defeatist bullshit.
Make them drag you ckicking and screaming. Only morons and cowards walk in lock-step with the corpos
Then don’t use these websites and this is a non issue
Ah, but of course! Why didn’t I think of closing my bank account?
The argument from the “it’s a trap” article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.
I have to admit that I haven’t investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.
The web api for fido2/passkeys exposes attestation information.
from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
Mozilla’s warning is funny. “Don’t use this to reject attestations from unapproved authenticators!” That’s, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?
I did read that part, but like you, I haven’t been able to independently verify it yet.
Which most people don’t do.
They’ll learn like I did the hard way. Lol