3 ms·
The specification is open, so anyone can create their own implementation. However, the implementation also supports attestation, which means a website is able
by crote 4y ago
The specification is open, so anyone can create their own implementation.
However, the implementation also supports attestation, which means a website is able to only allow certain "trusted" passkey implementations.
- EvanAnderson 4y agoSo, no— self-hosted won’t realistically be an option because “security”. I should just give up and live in a shack in the woods. The entire industry is hell-bent on subjugating me to one of the big-tech fiefdoms.
- allset_ 4y agoAttestation for hardware-backed FIDO authenticators is worthwhile. You can attest to various properties, such as whether or not the credential is protected by a PIN.
- deleted 4y ago[deleted]
- EvanAnderson 4y agoOf course it has value, but it’s a tradeoff for freedom. I don’t want that “security”, personally. I would love to not do business with anyone who requires that of me. Unfortunately, I think that will increasingly force disconnection from society.
- __MatrixMan__ 4y agoIt's presumably the authorized party who has the most to lose if the passkey backend is compromised, so it seems weird that the who-to-trust-for-auth decision falls to the web service. I'm reminded of a sign in front of my neighbor's driveway: "Ford parking only"