4 ms·
> I could be wrong but I don't think the standard requires that the keys are stored out of user reach. It really doesn't matter what the standard requires when
by bakugo 4y ago
> I could be wrong but I don't think the standard requires that the keys are stored out of user reach.
It really doesn't matter what the standard requires when the most popular implementations belong to companies like Google or Apple, they will get to decide how it works.
- stetrain 4y agoSo you think Google and Apple will block third party password managers from providing passkeys to the browser?
- bakugo 4y agoYes, I do.
- stetrain 4y agoThat's strange and would be a pretty big about-face. Apple, the most locked-down and proprietary OS vendor, has great support for third party password managers in their OSes and has been improving that support in recent years. If they kick 1Password etc. out of the Mac/iOS ecosystem that would be a pretty big deal. It could happen, but why would they do so?
- piperswe 4y agoThat would be strange, given that Passkeys are just Webauthn tokens synchronized across devices. I don't know of a single application that only supports one vendor of Webauthn token, and I don't see that changing soon.
- josephcsible 4y agoNot quite, but close. They'll convince website owners that for "security reasons", they should refuse passkeys that came from third-party password managers or anything else open source, and instead only accept ones that came from something remotely attestable to be theirs.
- stetrain 4y agoThen why bother with Webauthn and the FIDO alliance instead of just making this part of Sign in with Apple / Sign in with Google? That seems easier for Apple and Google if their plan is to be the only sign-in providers.
- bakugo 4y agoEver heard of "embrace, extend, extinguish"?
- brookst 4y agoLet me get this straight. . . You think Google will provide hooks for password managers in Chrome and Android, and then “convince” website owners, presumably via super bowl ads or something, to detect and filter out passkeys coming from the password managers they did the work to enable?
- HWR_14 4y agoGoogle convinces website owners of things all the time. Remember how AMP became popular because otherwise Google lowered your website's ranking?
- codedokode 4y agoStandards like WebAuthn support attestation of a key storage, so the site can see who has manufactured it and can choose not to trust weird DIY or open source solutions without an attestation certificate.
- squirrel_fetus 4y agoThe way I interpret it, the worry is that something happens that allows Google, Apple, Microsoft, or some other password aggregator to take advantage of a perfect storm event (whether real or manufactured surreptitiously). An example situation that comes to mind most easily would be some password aggregator having passwords stolen without realizing it. Let's assume that there's some backdoor or vulnerability in at least one system that allows bulk downloading of unencrypted username/password pairs and contact information. Then let's say a kid gets hold of that and thinks it might be funny to bulk send everyone's passwords to all of their contacts. The password aggregator that has a truck driven through its security hole hopefully looses business. But then Google, Apple, Microsoft, etc., say something to the effect of... "See? You really can't trust *anyone* but us. We are truly perfect and without any more truck holes of course. If people really wanted independent 2-factor authentication, they would have used it! Lots of people didn't, and look what happened. We need to save people from themselves!" ...Then the hooks come out.