4 ms·

Not quite, but close. They'll convince website owners that for "security reasons", they should refuse passkeys that came from third-party password managers or a

Not quite, but close. They'll convince website owners that for "security reasons", they should refuse passkeys that came from third-party password managers or anything else open source, and instead only accept ones that came from something remotely attestable to be theirs.

stetrain 4y ago
Then why bother with Webauthn and the FIDO alliance instead of just making this part of Sign in with Apple / Sign in with Google? That seems easier for Apple and Google if their plan is to be the only sign-in providers.
- bakugo 4y ago
  Ever heard of "embrace, extend, extinguish"?
brookst 4y ago
Let me get this straight. . . You think Google will provide hooks for password managers in Chrome and Android, and then “convince” website owners, presumably via super bowl ads or something, to detect and filter out passkeys coming from the password managers they did the work to enable?
- HWR_14 4y ago
  Google convinces website owners of things all the time. Remember how AMP became popular because otherwise Google lowered your website's ranking?
- codedokode 4y ago
  Standards like WebAuthn support attestation of a key storage, so the site can see who has manufactured it and can choose not to trust weird DIY or open source solutions without an attestation certificate.
- squirrel_fetus 4y ago
  The way I interpret it, the worry is that something happens that allows Google, Apple, Microsoft, or some other password aggregator to take advantage of a perfect storm event (whether real or manufactured surreptitiously). An example situation that comes to mind most easily would be some password aggregator having passwords stolen without realizing it. Let's assume that there's some backdoor or vulnerability in at least one system that allows bulk downloading of unencrypted username/password pairs and contact information. Then let's say a kid gets hold of that and thinks it might be funny to bulk send everyone's passwords to all of their contacts. The password aggregator that has a truck driven through its security hole hopefully looses business. But then Google, Apple, Microsoft, etc., say something to the effect of... "See? You really can't trust *anyone* but us. We are truly perfect and without any more truck holes of course. If people really wanted independent 2-factor authentication, they would have used it! Lots of people didn't, and look what happened. We need to save people from themselves!" ...Then the hooks come out.

stetrain 4y ago

Then why bother with Webauthn and the FIDO alliance instead of just making this part of Sign in with Apple / Sign in with Google? That seems easier for Apple and Google if their plan is to be the only sign-in providers.

bakugo 4y ago
Ever heard of "embrace, extend, extinguish"?

brookst 4y ago

Let me get this straight. . . You think Google will provide hooks for password managers in Chrome and Android, and then “convince” website owners, presumably via super bowl ads or something, to detect and filter out passkeys coming from the password managers they did the work to enable?

HWR_14 4y ago
Google convinces website owners of things all the time. Remember how AMP became popular because otherwise Google lowered your website's ranking?
codedokode 4y ago
Standards like WebAuthn support attestation of a key storage, so the site can see who has manufactured it and can choose not to trust weird DIY or open source solutions without an attestation certificate.
squirrel_fetus 4y ago
The way I interpret it, the worry is that something happens that allows Google, Apple, Microsoft, or some other password aggregator to take advantage of a perfect storm event (whether real or manufactured surreptitiously). An example situation that comes to mind most easily would be some password aggregator having passwords stolen without realizing it. Let's assume that there's some backdoor or vulnerability in at least one system that allows bulk downloading of unencrypted username/password pairs and contact information. Then let's say a kid gets hold of that and thinks it might be funny to bulk send everyone's passwords to all of their contacts. The password aggregator that has a truck driven through its security hole hopefully looses business. But then Google, Apple, Microsoft, etc., say something to the effect of... "See? You really can't trust *anyone* but us. We are truly perfect and without any more truck holes of course. If people really wanted independent 2-factor authentication, they would have used it! Lots of people didn't, and look what happened. We need to save people from themselves!" ...Then the hooks come out.