3 ms·
Yes you need to trust your operating system developer to some extent. If your threat model includes not trusting the company that writes the source code to you
by doublepg23 3y ago
Yes you need to trust your operating system developer to some extent.
If your threat model includes not trusting the company that writes the source code to your OS…don’t use computers I guess?
- devsda 3y agoThe concern is not about trust but gatekeeping the providers. For example in the case of email, you generaly dont worry about google reading your email but we should definitely be concerned if gmail allows send & recieve from only few domains or providers it chooses.
- __MatrixMan__ 3y agoSuppose one does trust their OS developers. And they want to use some passkey-protected service. Does that service also have to trust the OS developers? Correct me if I'm wrong, but I'm under the impression that services can decide whose passkey implementations to trust. Seems like that should be up to the user, not the service.
- ptman 3y agoThe user picks the passkey, don't they? Android, Apple or Microsoft. Or Yubikey, or another token.