7 ms·

This is a big shift away from user's having control and towards big tech and device manufacturers having control. A device that can do signing for authenticati

This is a big shift away from user's having control and towards big tech and device manufacturers having control. A device that can do signing for authentication can also do signing for authorization and, since the keys can be stored in a TPM, there's nothing you can do about it. The authorization half of the plan is going to come after everyone has adopted it for authentication. I'm convinced the technology in play here is going to be used against users. Get ready for "authorized actions" in the applications you depend on.

WorldMaker 3y ago
Everything about Passkeys are open standards. Open-source implementations already exist. Third party choices for passkeys outside of device manufacturers are already available if you don't trust your device ecosystem. Passkeys only survive so long as the Big Three (Apple, Google, Microsoft) push them together for mainstream users and it is a lot to suggest that those three companies can get along long enough and agree generally enough to conspire against their user's interests. If they show signs of such a conspiracy, there are anti-trust laws to deal with that. (Plus, as I said, open source and third party alternatives already.) But if we want to talk specifics rather than hypotheticals: there actually is a FIDO standard somewhat close to what you are afraid will happen called "Device Attestation". This allows TPMs to attest (sign) that a given key came from a specific type of Device, or even in theory a specific Device. Enterprises want this because it is an asset management and additional layer of security tool to make sure only approved devices have access to corporate stuff. Microsoft and Google have implemented it to various degrees. Apple on the other hand has made it publicly clear that they don't like the privacy and user security implications of Device Attestations and just plain aren't supporting it in their Passkey implementation. I can't prove that there aren't conspiratorial things happening behind the scenes between the Big Three, but at least in these specifics you have public evidence (in both words and actions to date) from one of the Big Three that they care about the privacy of their users much more than they care about what enterprise customers demand and are going to publicly disagree with the other two companies in the Big Three about it. Again, I doubt I can prove to you that the conspiracy doesn't exist, but it is so entirely unlikely given what we've seen so far.
- donmcronald 3y ago
  > Again, I doubt I can prove to you that the conspiracy doesn't exist, but it is so entirely unlikely given what we've seen so far. I don't think there's a big conspiracy. I think it's the logical end result of having that technology built, adopted, and at a critical mass. If you can do device attestation or identity attestation for an authentication request, it's not much of a stretch to think that can easily be extended to make arbitrary requests for a user or app to be allowed to perform an action. I think that'll be focused around accessing data. For example, what if copy / paste is an authorized action that only gives you encrypted data which requires a key from your TPM to be decrypted and the TPM is only willing to decrypt it for a specific app / process? I view it about the same as having a GPG key that I escrow with Microsoft and that key is used to sign, attest, encrypt, decrypt, etc.. I think Passwordless is the system that's going to get a majority of users set up with keys that are "escrowed" behind a TPM (or similar). I think the temptation to gate your data behind a key you don't control is going to be too much for big tech to resist. I bet a ton of people and business will even opt in to a system like that if they're sold the promise of having their data secured from bad actors. It's not even a false promise at that point. It's just that you have to give up control of your data for it to work.

WorldMaker 3y ago

Everything about Passkeys are open standards. Open-source implementations already exist. Third party choices for passkeys outside of device manufacturers are already available if you don't trust your device ecosystem. Passkeys only survive so long as the Big Three (Apple, Google, Microsoft) push them together for mainstream users and it is a lot to suggest that those three companies can get along long enough and agree generally enough to conspire against their user's interests. If they show signs of such a conspiracy, there are anti-trust laws to deal with that. (Plus, as I said, open source and third party alternatives already.) But if we want to talk specifics rather than hypotheticals: there actually is a FIDO standard somewhat close to what you are afraid will happen called "Device Attestation". This allows TPMs to attest (sign) that a given key came from a specific type of Device, or even in theory a specific Device. Enterprises want this because it is an asset management and additional layer of security tool to make sure only approved devices have access to corporate stuff. Microsoft and Google have implemented it to various degrees. Apple on the other hand has made it publicly clear that they don't like the privacy and user security implications of Device Attestations and just plain aren't supporting it in their Passkey implementation. I can't prove that there aren't conspiratorial things happening behind the scenes between the Big Three, but at least in these specifics you have public evidence (in both words and actions to date) from one of the Big Three that they care about the privacy of their users much more than they care about what enterprise customers demand and are going to publicly disagree with the other two companies in the Big Three about it. Again, I doubt I can prove to you that the conspiracy doesn't exist, but it is so entirely unlikely given what we've seen so far.

donmcronald 3y ago
> Again, I doubt I can prove to you that the conspiracy doesn't exist, but it is so entirely unlikely given what we've seen so far. I don't think there's a big conspiracy. I think it's the logical end result of having that technology built, adopted, and at a critical mass. If you can do device attestation or identity attestation for an authentication request, it's not much of a stretch to think that can easily be extended to make arbitrary requests for a user or app to be allowed to perform an action. I think that'll be focused around accessing data. For example, what if copy / paste is an authorized action that only gives you encrypted data which requires a key from your TPM to be decrypted and the TPM is only willing to decrypt it for a specific app / process? I view it about the same as having a GPG key that I escrow with Microsoft and that key is used to sign, attest, encrypt, decrypt, etc.. I think Passwordless is the system that's going to get a majority of users set up with keys that are "escrowed" behind a TPM (or similar). I think the temptation to gate your data behind a key you don't control is going to be too much for big tech to resist. I bet a ton of people and business will even opt in to a system like that if they're sold the promise of having their data secured from bad actors. It's not even a false promise at that point. It's just that you have to give up control of your data for it to work.