3 ms·

I believe security keys are the offline version of passkeys you're looking for. I am afraid that websites will somehow disable support security keys and only s

• blibble 3y ago
  yes, there's an attestation cert as part of the register request
  • pabs3 3y ago
    I hear that the way Big Tech implements passkeys means that it is impossible to require attestation to prove use of their implementations.
• vineyardmike 3y ago
  I wouldn’t be surprised if you’re right, but I think it’s not all bad to only use auth from big tech - I don’t know if I trust most small companies to implement uname/password auth correctly. Most users recycle passwords too so a leak is really bad. I think the reason to only support big tech passkey auth is because users (at scale) can’t be trusted to keep track of their hardware keys.