4 ms·

> Why do the blessed vendors get to do that but not 3rd parties? That's exactly what we're all asking :) I feel like you're possibly arguing that the tech its

> Why do the blessed vendors get to do that but not 3rd parties? That's exactly what we're all asking :) I feel like you're possibly arguing that the tech itself doesn't require platform lock-in, and I absolutely agree with that. This is a policy issue, not a tech issue (well, attestation, but that's a different conversation). But it's policy issue that's shared by all of the major companies involved in the FIDO alliance and they're very suspiciously against offering any policy solutions or requirements in the passkey specification itself. There's no technical reason at all why Apple couldn't support syncing passkeys to a local backup that can be imported by other authenticators. From that perspective you're completely right. They just don't.

dcow 3y ago
Right. I just wanted to make that clear. That’s why I say there’s no fundamental difference between the two technologies and compare webauthn to passwords of yore. In terms of policy, I am not sure all the players share the sentiment. Google stated they understand the importance of passkeys being cross platform. So at least, if their statement is to be trusted, they’re on the side of consumers.
- danShumway 3y ago
  I come down really hard on passkeys sometimes, but I'm not opposed to the idea of using keys for authentication. I think that's an amazing idea. I'm mostly down on the passkey ecosystem and who's in charge of it. I guess I don't do a good job of clarifying that always. There is a theoretical alternate world where the FIDO Alliance approached this differently where I would be 100% on board with passkeys and would be encouraging everyone to switch to them. I'm just really worried about the implementations I think we're going to actually end up with.
  - JohnFen 3y ago
    I like the passkey idea in the general sense, too. But what I don't like is the involvement of a third party, and the loss of control over my own critical data.

dcow 3y ago

Right. I just wanted to make that clear. That’s why I say there’s no fundamental difference between the two technologies and compare webauthn to passwords of yore. In terms of policy, I am not sure all the players share the sentiment. Google stated they understand the importance of passkeys being cross platform. So at least, if their statement is to be trusted, they’re on the side of consumers.

danShumway 3y ago
I come down really hard on passkeys sometimes, but I'm not opposed to the idea of using keys for authentication. I think that's an amazing idea. I'm mostly down on the passkey ecosystem and who's in charge of it. I guess I don't do a good job of clarifying that always. There is a theoretical alternate world where the FIDO Alliance approached this differently where I would be 100% on board with passkeys and would be encouraging everyone to switch to them. I'm just really worried about the implementations I think we're going to actually end up with.
- JohnFen 3y ago
  I like the passkey idea in the general sense, too. But what I don't like is the involvement of a third party, and the loss of control over my own critical data.