4 ms·

I personally am wary over passkey. An Android update to my S21 earlier this year dropped support for hardware keys. Now whenever I try to sign into a site that

I personally am wary over passkey. An Android update to my S21 earlier this year dropped support for hardware keys. Now whenever I try to sign into a site that expects my hardware key the Google passkey dialog pops up and I have no way to use my hardware key to sign in. I wouldn't mind passkeys if Android continues to support the hardware keys alongside passkey but to replace the former with the latter is a step too far for me. I do wonder what the motivation behind passkey is if they're willing to drop support for hardware keys without any notification and push passkey instead.

bonton89 3y ago
Passkeys have attestation as a specified feature and nothing about interoperability, so the motivation is exclusion of certain classes of devices from services.
- lxgr 3y ago
  Passkeys (at least the cloud-synchronized kind) don’t support attestation. At least none of the existing implementations do. Edit: authentication -> attestation
  - danShumway 3y ago
    I assume you're talking about attestation here, not authentication? My question is, as always: > At least none of the existing implementations do. So why isn't that in the spec? Unless something has changed in the past month or so, the only reason why attestation for roaming keys is less of an issue is because Apple has voluntarily completely of its own volition decided to zero out information in its implementation. That's turned out not to be enough; it's trivial to find accounts online of people complaining that they've tried to register passkeys from alternate providers and have found out that websites are checking browser agents or using other measures to restrict which keys can be registered. But ignoring that and only focusing on actual attestation using the mechanisms that FIDO has built into WebAuthn, why is an Open standard relying on Apple's goodwill for such an important decision? Why do we have a standard that specifies how to lock down devices through hardware attestation and that relies on providers optionally choosing to do the right thing and ignore that mechanism, but that thinks it would be overreaching for the Alliance to mandate ecosystem transfer or to block discrimination against providers/authenticators?
    - bonton89 3y ago
      > ...it's trivial to find accounts online of people complaining that they've tried to register passkeys from alternate providers and have found out that websites are checking browser agents or using other measures to restrict which keys can be registered. I knew this was going to happen but I thought they'd wait until there was more broad adoption before the screws started turning.

bonton89 3y ago

Passkeys have attestation as a specified feature and nothing about interoperability, so the motivation is exclusion of certain classes of devices from services.

lxgr 3y ago
Passkeys (at least the cloud-synchronized kind) don’t support attestation. At least none of the existing implementations do. Edit: authentication -> attestation
- danShumway 3y ago
  I assume you're talking about attestation here, not authentication? My question is, as always: > At least none of the existing implementations do. So why isn't that in the spec? Unless something has changed in the past month or so, the only reason why attestation for roaming keys is less of an issue is because Apple has voluntarily completely of its own volition decided to zero out information in its implementation. That's turned out not to be enough; it's trivial to find accounts online of people complaining that they've tried to register passkeys from alternate providers and have found out that websites are checking browser agents or using other measures to restrict which keys can be registered. But ignoring that and only focusing on actual attestation using the mechanisms that FIDO has built into WebAuthn, why is an Open standard relying on Apple's goodwill for such an important decision? Why do we have a standard that specifies how to lock down devices through hardware attestation and that relies on providers optionally choosing to do the right thing and ignore that mechanism, but that thinks it would be overreaching for the Alliance to mandate ecosystem transfer or to block discrimination against providers/authenticators?
  - bonton89 3y ago
    > ...it's trivial to find accounts online of people complaining that they've tried to register passkeys from alternate providers and have found out that websites are checking browser agents or using other measures to restrict which keys can be registered. I knew this was going to happen but I thought they'd wait until there was more broad adoption before the screws started turning.