7 ms·

Passkeys aren’t device-bound. I think they’ll work just fine. The real problem, though, is that we seem to need digital identity solutions to be perfect as op

• fantasybroker 3y ago
  Personally, I like the idea of hardware-tied auth (phone/FIDO2 key), that could work for me eventually. However, I am also one of the "anon-in-the-ether" people and don't want a permanent identity on any public service. A permanent identity comes with many additional mechanics, far beyond just a stable identifier. The biggest one is post karma (including likes): IMO it's at the core of almost everything what's wrong with the modern web. It introduces vile personal and group incentives and leads to an eventual destruction of any honest conversation. While this mechanic exists on public forums, I won't use a permanent identity.
  • pseudalopex 3y ago
    Stable identifiers were common decades before karma or likes.
    • fantasybroker 3y ago
      Yup, I used to use them back then.
      • pseudalopex 3y ago
        You said stable identifiers come with karma and likes. But you know they come without also.
        • fantasybroker 3y ago
          I mean - yes? I understand what a stable identifier is. Having a unique user ID in a database doesn't magically enable likes on all features. But for the purpose of this discussion I limited my opinion to "public services", i.e. services with a social aspect, which overwhelmingly have this mechanic (to such an absurd extent that I can "like" payments made by people I don't know on Venmo).
          • pseudalopex 3y ago
            > I understand what a stable identifier is. You do not understand what core is apparently.
            • fantasybroker 3y ago
              From what I understand "core" is a central part of a fruit.
  • dcow 3y ago
    I’d challenge you to live life without a government ID, and without giving your phone number to any “public service”. I’m sure we could be more private than we are, but you aren’t going to get far without your permanent ID.
• pc86 3y ago
  I definitely don't consider myself a "privacy schooler" (whatever that means) but government-issued ID credentials tied to "self-sovereign wallets" (whatever that means) sounds like a, pardon my french, absolute fucking nightmare. But agreed with your other point that we'd probably stop giving ID up as easily if that was the cost of recovery.
  • riffraff 3y ago
    You have government issued id credentials tied to government controlled bank accounts and cards, a wallet per se would not change much.
    • xerox13ster 3y ago
      Those are not signifiers for my entire digital life and allowing them to be a single trackable signifier online gives corporations and governments carte blanche to track every movement we make online in perpetuity, forever once that cat is out of the bag. It will be worse than the WEI framework in terms of restricting access to a certain class of people. If you're already disadvantaged and don't have the ability to provide documents to the DOL proving who you are, how are you supposed to get access to your online identity again to get into a mail account and try to apply for work or housing? Imagine someone steals your real world wallet and gets your online identity credentials, goes posting revenge porn and crypto spam and gets you booted off every platform. You get cancelled and lose your job because your online identity is tied explicitly to meat space and the court of public opinion operates on guilty even after proving innocence. Meanwhile you're trying to recover your life--social, physical, and digital--, but can't get into any platforms online. None of your accounts work anymore. You can't access your backups, or get into your contacts because your device is no longer trusted because it's tied to a blocked Microsoft/Google/Apple account. You can't access your house because your IoT security is tied to your online accounts which have been disabled. You can't access your physical documents safe. You have to break into your house. You can't scan the QR code or NFC to verify identity after providing the alarm code. Police come, and arrest you because you can't prove who you are. You're crazed about your situation, babbling because of the insanity of it all and look like someone trying to steal a nice homeowner's documents. I realize that's a pretty extreme Black Mirror level example a bit like Nosedive, but it's in the realm of possibility if we go down that route knowing that corporations are already trying to do device attestations. Maybe you'd have the prescience to have a physical security layer 0 for your IoT security, but many products people purchase won't because having to carry a key defeats the purpose of having the tech solution. The scary enough reality is that if there is a single government provided signifier for an individual online, we will inevitably see sweeping tracking and censorship. They do as much as they can possibly do now. Why on Earth would anyone ever think they wouldn't do more? No, thanks.
• mooreds 3y ago
  > Passkeys aren’t device-bound. I think they’ll work just fine. Depends on the implementation. Some passkeys are device bound. The free ones, typically. Unless you trust Apple and Google to preserve and protect private keys.
  • dcow 3y ago
    WebAuthn can be device bound. A Passkey is webauthn with nil authdata.
• jml7c5 3y ago
  >Passkeys aren’t device-bound. I think they’ll work just fine. Is there anywhere to follow progress on this? I don't think anyone actually implements import/export of passkeys yet.
  • rdl 3y ago
    Don't they work pretty portably within Apple iCloud keychain or Google equivalent (but only one)? I think some of the legacy password managers are supporting this as well, although my preferred self-hosted vaultwarden option doesn't yet (bitwarden has support, but I don't think it is in the self hosted version yet, let alone in vaultwarden) There are ways to set passkeys as non-exportable from device I think but that is not the default.
    • pseudalopex 3y ago
      Bound to devices chosen by Apple or Google is device bound. What does legacy mean to you? The usual meaning of outdated is inapplicable in this case.
      • dcow 3y ago
        No it’s not. At least that’s not what anybody in the security community means when they say device bound. Device bound implies the key is cryptographically tied to a piece of unique physical hardware.
      • rdl 3y ago
        Device bound is to a specific piece of hardware (whether it supports reinstallation at some level is debatable but I wouldn't use the term for it; Signal is essentially single-concurrent-device-limited even though it has migration capability, but since it can be exported, it's not truly device bound. Apple, Google keychain lock-in is vendor or maybe account lock-in, not device lock-in. "Non-exportable" keys from a secure enclave make it device bound, although a sufficiently functional reprovisioning process might make that only a technical distinction. Passwords are "legacy" security technology at this point (in the sense of being outdated and bordering on obsolete, and yet still needing to be supported) -- password managers are tools to manage that legacy technology.
• CatWChainsaw 3y ago
  Sorry, how are passkeys not device bound? Every single article I read explaining why they're "better than passwords" touts precisely this as a strength - your authentication takes place on device, so there's no server of passwords for anyone to hack. If you lose the devices your passkeys are paired to, you've locked yourself out of that account for good.
• AnthonyMouse 3y ago
  > Imagine if everyone just used mobile drivers licenses issued to whatever self-sovereign wallet the user chooses. Identity issuing, revocation, and recovery is then handled by all the things society has already built to handle meatspace identity. But why do you need to tie it to your driver's license? Tie it to whatever kind of account recovery token you like, put that in a safety deposit box at a bank (available for ~$20/year), and then you can get access to that with your government ID if all else fails. This requires no new infrastructure to screw up or get broken into and doesn't tie your internet activity to your name while still allowing you to use your name to recover your accounts. > Relying parties that need human uniqueness, age, and/or nationality guarantees use the mDL verifiable credential. This is variously unnecessary and ineffective. The correct way to do age verification is to ask the client's browser if the user is a minor. If the user is a minor, either their parents will have configured the device to answer truthfully or the minor has access to an adult willing to allow it, against which no remote system is secure anyway because the adult has an adult ID. This is the same reason human verification doesn't work like that. You still have no idea if you're talking to a human, all you know is the device on the other end has somebody's ID attached. Individuals who aren't supposed to be using AI still have a human ID and criminal organizations not only have their own IDs but also any they can steal. It's not clear why proving nationality over the internet is necessary but most of the obvious use cases are dystopian and requiring you to visit a physical office once in your life to prove your nationality to some bureaucracy (after which you can use your account) seems like a minor burden -- and more secure -- than trying to do this. That kind of system is not worth the candle. The tracking risk is large, the benefit is small, there are too many ways to screw it up and it would inevitably be politically compromised and hard to change.
  • dcow 3y ago
    You can use whatever credential society is willing to trust. Practically that’s a state-issued ID. All I’m arguing is that we should extend the concept of your state ID cryptographically into cyberspace. Amd that it should be used for recovery flows where real identity matters. There’s nothing new here (society already works this way) other than the protocols and specs to agree on document and signature format, which is luckily something we happen to excel at managing. None of your counter suggestions solve any practical problems. A liquor store isn’t going to simply “ask the user” whether they’re of age. They need more formal proof. Users don’t rent safe deposit boxes at banks, and even if they did that would be chained back to your physical ID anyway so your apparent solution isn't a real solution. The dystopian worries are hyperbolic and mostly FUD. If a service needs your info and you need the service, you’ll give it to them. Anyway mobile DL is already happening. I’d rather a state that I have at least a modicum of control over be the root of my digital identity than some corporate run email system than can evict me without cause.