3 ms·
> Guaranteess that attestation won't be used to block KeePassXC from being used as an authenticator. What would such a guarantee look like? It's very hard to p
by brookst 4y ago
> Guaranteess that attestation won't be used to block KeePassXC from being used as an authenticator.
What would such a guarantee look like? It's very hard to promise that something will never happen.
I guess some kind of industry standard for criteria that a pass key manager must meet, and platforms accepting pass keys would promise to support any system meeting those criteria?
Trying to predict every future gets hard. There are unlikely but possible scenarios where we would want something like KeePassXC to be cut off (e.g. they or a similar product steals credentials).
- danShumway 4y ago> I guess some kind of industry standard for criteria that a pass key manager must meet, and platforms accepting pass keys would promise to support any system meeting those criteria? Basically what I would want. Or (better) for attestation to just not be a part of the spec in the first place. I don't think services should have the choice of cutting off authenticators. See sibling comments though, if Apple refuses to support attestation for platform keys, then requiring attestation effectively means cutting off the iPhone market, which is the next best thing to getting rid of attestation entirely.