3 ms·
Just like there are diehards still running their own email servers (kudos to them), will there be people running their own passkey backends? If so, I'm open mi
by __MatrixMan__ 4y ago
Just like there are diehards still running their own email servers (kudos to them), will there be people running their own passkey backends?
If so, I'm open minded. If it's a situation where you have to be in some kind if in-group to do that, then I'm preparing to be as much of a Luddite as I need to in order to avoid them.
- crote 4y agoThe specification is open, so anyone can create their own implementation. However, the implementation also supports attestation, which means a website is able to only allow certain "trusted" passkey implementations.
- EvanAnderson 4y agoSo, no— self-hosted won’t realistically be an option because “security”. I should just give up and live in a shack in the woods. The entire industry is hell-bent on subjugating me to one of the big-tech fiefdoms.
- allset_ 4y agoAttestation for hardware-backed FIDO authenticators is worthwhile. You can attest to various properties, such as whether or not the credential is protected by a PIN.
- deleted 4y ago[deleted]
- EvanAnderson 4y agoOf course it has value, but it’s a tradeoff for freedom. I don’t want that “security”, personally. I would love to not do business with anyone who requires that of me. Unfortunately, I think that will increasingly force disconnection from society.
- __MatrixMan__ 4y agoIt's presumably the authorized party who has the most to lose if the passkey backend is compromised, so it seems weird that the who-to-trust-for-auth decision falls to the web service. I'm reminded of a sign in front of my neighbor's driveway: "Ford parking only"