3 ms·

this is part of the: passkeys as the ultimate centralized online identity plan.

by ksjskskskkk 3y ago

jeroenhd 3y ago
How do randomly generated cryptographic keys change anything? They're just usernames+passwords that you don't need to remember.
- walterbell 3y ago
  > that you don't need to remember On iOS, can pseudonymous passkeys be generated and entered by a password manager app, without being stored with the iCloud identity keychain?
  - tzs 3y ago
    You can with 1Password. Bitwarden I believe says that mobile passkey support is coming.
  - jeroenhd 3y ago
    I don't have any up to date iDevices but I'm pretty sure you can. Android is the one behind here, only allowing apps to integrate through the standard API starting with Android 14.
- bonton89 3y ago
  And eventually, device attestation you cannot change.
  - jeroenhd 3y ago
    You can install several apps to use as passkeys, or use NFC keys, or Bluetooth keys, or WearAuthn on your Android smartwatch. If an app or website implements device attestation through passskeys, that's device attestation in the same way your house key is device attestation: you need the device to unlock the door.
- ksjskskskkk 3y ago
  because in the very near future everywhere will only accept a couple issuers. not even paranoia, already happened once. just like oauth in the beginning and then everyone cried about how ugly their design was with "oauth nascar" and then only accept google or apple. it already happened once. today you can only login on saas with github (Microsoft). etc. this passkey push will boast openess, then on day one spam will take over and will serve as the excuse to limit to google or apple attestation only. as usual. and by then it will be too late because everyone was mislead by the initial promissed openess, and like you, might even have happily added it to your service, increasing the adoption momentum.

3 ms·

this is part of the: passkeys as the ultimate centralized online identity plan.

by ksjskskskkk 3y ago

this is part of the: passkeys as the ultimate centralized online identity plan.

jeroenhd 3y ago
How do randomly generated cryptographic keys change anything? They're just usernames+passwords that you don't need to remember.
- walterbell 3y ago
  > that you don't need to remember On iOS, can pseudonymous passkeys be generated and entered by a password manager app, without being stored with the iCloud identity keychain?
  - tzs 3y ago
    You can with 1Password. Bitwarden I believe says that mobile passkey support is coming.
  - jeroenhd 3y ago
    I don't have any up to date iDevices but I'm pretty sure you can. Android is the one behind here, only allowing apps to integrate through the standard API starting with Android 14.
- bonton89 3y ago
  And eventually, device attestation you cannot change.
  - jeroenhd 3y ago
    You can install several apps to use as passkeys, or use NFC keys, or Bluetooth keys, or WearAuthn on your Android smartwatch. If an app or website implements device attestation through passskeys, that's device attestation in the same way your house key is device attestation: you need the device to unlock the door.
- ksjskskskkk 3y ago
  because in the very near future everywhere will only accept a couple issuers. not even paranoia, already happened once. just like oauth in the beginning and then everyone cried about how ugly their design was with "oauth nascar" and then only accept google or apple. it already happened once. today you can only login on saas with github (Microsoft). etc. this passkey push will boast openess, then on day one spam will take over and will serve as the excuse to limit to google or apple attestation only. as usual. and by then it will be too late because everyone was mislead by the initial promissed openess, and like you, might even have happily added it to your service, increasing the adoption momentum.