3 ms·
Rubbish. This is literally WebAuthn, a completely open standard. There is no hidden secret sauce here, proprietary vendor lock-in, nothing. We’ve had the funct
by lll-o-lll 4y ago
Rubbish. This is literally WebAuthn, a completely open standard. There is no hidden secret sauce here, proprietary vendor lock-in, nothing.
We’ve had the functionality forever with Yubikey and so on, the difference is the tight integration with these common platforms making for ease of use.
The website you are accessing knows nothing about your device, it’s just doing a protocol dance. You can do it too! I’m sure someone will create a crap, insecure, WebAuthn client so that you can keep using your passwords.
- knaik94 4y agoI look forward to using that crap insecure WebAuthn client. A private key I don't control is a much bigger security issue than a compromised password will ever be. Google currently has no plans of supporting linux for "Local user verification" or "Passkey sync". If it was a truly open standard, I don't see why that would be the case. Needing to use a Google account is the definition of propriety vendor lock-in. Relying on specific hardware is the reason why I haven't embraced Yubikeys. I understand the assumption that the general population doesn't care to and shouldn't need to worry about managing their private keys. But there's nothing secure about not giving me the option to, if I want to. https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....
- codedokode 4y ago> The website you are accessing knows nothing about your device, That is not correct. WebAuthn supports attestation of a hardware key storage, which means site operators can refuse to accept your keys unless you use a device from a white list.