3 ms·
I think you can swap out FIDO in the role of certification for any other group willing to run the process of certifying devices, so it is basically just CA styl
by yayana 8y ago
I think you can swap out FIDO in the role of certification for any other group willing to run the process of certifying devices, so it is basically just CA style PKI for client certs again but with an initial attempt at a free CA.
I think FIDO specifications and most organizations feeling pressure to at least support devices they approve would mostly be good for the user.
The rate FIDO will introduce more invasive behavior instead of user benefiting behavior before there is a version too common for most sites to reject is going to be related to the level proprietary dongles issued by Banks, etc, remain acceptable.
In the FIDO case, the consumer actually is the customer, so negative features will have to arrive by vendors fighting their own customers interests, and pushing institutions to reject their older devices. I think they probably will, but not at the rate they can fight users when the institution is the customer.
- dane-pgp 8y agoA likely scenario is that, just as with mobile OSes or browsers, there will be effectively an oligarchy or cartel of approved FIDO device manufacturers, who will end up setting the rules to make it hard for new manufacturers to join the trusted set. This is basically a huge coordination problem, and there are natural barriers to entry against becoming a globally accepted provider of hardware which websites are prepared to trust. History has shown that, as long as a market appears to have two options, people will be content to choose the lesser or two evils rather than invest time and effort into changing the system to add more options.