4 ms·

How? you make claims that seem to have no substance. What extra vector does Passkeys add for tracking? I don't see any. Passkeys are an origin-bound login mech

How? you make claims that seem to have no substance. What extra vector does Passkeys add for tracking? I don't see any. Passkeys are an origin-bound login mechanism. Worst case is that somebody places a first-party cookie to keep you logged in after you authenticated with a passkey. which they and will already do today without your consent or without logging in. (First-party session cookies don't even need a cookie wall. They're considered "necessary" processing)

vouaobrasil 3y ago
If it is easier to do something, more websites will do it. Passkeys make it easier to make new logins, so more websites will do it. Just like seatbelts make people drive more dangerously. If more websites require logins, they can track you more easily, simple as that. It has nothing to do with the engineering aspects of passkeys, and everything to do with the fact that technology which makes logins easier will encourage more login-based services. You need to step away from the engineering details and look at things sociologically.
- dan-robertson 3y ago
  Doesn’t Apple Pay make it easier to not log in to websites (by getting rid of their desire to save payment details or addresses to get through later checkouts faster)? I just don’t really see some grand pro-login plan implied by Apple’s actions.
  - vouaobrasil 3y ago
    You are right. Of course, I am not talking about a conscious plan by board members or employees, but the general emergent trend inherent to this type of technology. I did not mean to imply conscious action as we know it.
cj 3y ago
With 3rd party cookies going away, companies now need your email address to effectively track you. Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needing to be cookie-based). Passkeys = quicker and faster to get a user's email address. Email address = even better than "super cookies"
- dan-robertson 3y ago
  But Apple offer this service where they make a fresh proxy email for you which is unique to the service. Why would they do that if they want to enable cross-service tracking via email address?
  - withinboredom 3y ago
    I use 1password + fastmail for exactly this. The integration is better than Apple IMHO.
    - anderspitman 3y ago
      Do 1password/fastmail have functionality built in for this or do you just manually generate your emails based off a wildcard?
      - withinboredom 3y ago
        Yes. It’s built-in. https://1password.com/fastmail/ https://1password.com/fastmail/
        anderspitman 3y ago
        That's awesome
- closewith 3y ago
  > Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. At least in the EU, you'll need express consent to do this.
  - tourmalinetaco 3y ago
    “Need” is a very strong word. Any potential fines will just be rolled into the costs of doing business, and if it’s found to still be worth it they’ll keep abusing user privacy as there is a net benefit profit-wise.
mcherm 3y ago
Passkeys do not help track people between sites, but if they are used in places that passwords never were, it might increase tracking within a site. Hacker News, for instance, allows non-logged-in read-only usage. If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost. Personally, I don't think it is that much of a risk. I DO worry about putting too much control in the hands of Apple and Google.
- WorldMaker 3y ago
  If sites started going Passkey only even for "guest" access, you'd quickly see a rise in Passkey managers that quickly generate throwaway passkeys and you'd also see a rise in "globally shared" anonymous group passkeys, just as people already do today to get around paywalls and some walled gardens with passwords and "phone memberships" at rewards clubs (the notorious Jenny's Number being a common one there). The techniques don't really change that much. Passkeys really don't have any more identifying information than passwords or phone numbers and temporary anonymous passkeys or over-shared passkeys are likely to be a thing in some places as soon as they are seen as necessary.
- runeks 3y ago
  > If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost. Not if you the user generates a new login upon every visit, which should be trivial.

vouaobrasil 3y ago

If it is easier to do something, more websites will do it. Passkeys make it easier to make new logins, so more websites will do it. Just like seatbelts make people drive more dangerously. If more websites require logins, they can track you more easily, simple as that. It has nothing to do with the engineering aspects of passkeys, and everything to do with the fact that technology which makes logins easier will encourage more login-based services. You need to step away from the engineering details and look at things sociologically.

dan-robertson 3y ago
Doesn’t Apple Pay make it easier to not log in to websites (by getting rid of their desire to save payment details or addresses to get through later checkouts faster)? I just don’t really see some grand pro-login plan implied by Apple’s actions.
- vouaobrasil 3y ago
  You are right. Of course, I am not talking about a conscious plan by board members or employees, but the general emergent trend inherent to this type of technology. I did not mean to imply conscious action as we know it.

cj 3y ago

With 3rd party cookies going away, companies now need your email address to effectively track you. Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needing to be cookie-based). Passkeys = quicker and faster to get a user's email address. Email address = even better than "super cookies"

dan-robertson 3y ago
But Apple offer this service where they make a fresh proxy email for you which is unique to the service. Why would they do that if they want to enable cross-service tracking via email address?
- withinboredom 3y ago
  I use 1password + fastmail for exactly this. The integration is better than Apple IMHO.
  - anderspitman 3y ago
    Do 1password/fastmail have functionality built in for this or do you just manually generate your emails based off a wildcard?
    - withinboredom 3y ago
      Yes. It’s built-in. https://1password.com/fastmail/ https://1password.com/fastmail/
      - anderspitman 3y ago
        That's awesome
closewith 3y ago
> Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. At least in the EU, you'll need express consent to do this.
- tourmalinetaco 3y ago
  “Need” is a very strong word. Any potential fines will just be rolled into the costs of doing business, and if it’s found to still be worth it they’ll keep abusing user privacy as there is a net benefit profit-wise.

mcherm 3y ago

Passkeys do not help track people between sites, but if they are used in places that passwords never were, it might increase tracking within a site. Hacker News, for instance, allows non-logged-in read-only usage. If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost. Personally, I don't think it is that much of a risk. I DO worry about putting too much control in the hands of Apple and Google.

WorldMaker 3y ago
If sites started going Passkey only even for "guest" access, you'd quickly see a rise in Passkey managers that quickly generate throwaway passkeys and you'd also see a rise in "globally shared" anonymous group passkeys, just as people already do today to get around paywalls and some walled gardens with passwords and "phone memberships" at rewards clubs (the notorious Jenny's Number being a common one there). The techniques don't really change that much. Passkeys really don't have any more identifying information than passwords or phone numbers and temporary anonymous passkeys or over-shared passkeys are likely to be a thing in some places as soon as they are seen as necessary.
runeks 3y ago
> If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost. Not if you the user generates a new login upon every visit, which should be trivial.