3 ms·
That article is about as misleading as it's possible to be while still being technically right. The "attestation" feature of passkeys exists solely to let websi
by josephcsible 3y ago
That article is about as misleading as it's possible to be while still being technically right. The "attestation" feature of passkeys exists solely to let websites refuse to let you use passkeys tied to hardware you do control, or to software. The way this article only mentions it in passing and tries to downplay it reminds me of the joke of https://what-if.xkcd.com/49/ https://what-if.xkcd.com/49/ - a very long article listing a bunch of upsides of the Sun going out, and only one sentence about the downside: "We would all freeze and die."
- stavros 3y agoI guess we'll have to wait and see whether websites will force people to use specific authenticators. I don't think they will.
- julianwachholz 3y agoWe can already see this to some degree. On my Android device, Chrome will only let me create a synchronized passkey in a Google account UNLESS attachment is explicitly set to "cross-plattform" - even though not specifying the option is supposed to allow all types. You can try this out on webauthn.io and changing the attachment setting.