3 ms·

If the passkey protocol didn't support attestation, then that would be true. But since it does, passkeys aren't as good, since I can't make my own backups of th

If the passkey protocol didn't support attestation, then that would be true. But since it does, passkeys aren't as good, since I can't make my own backups of them.

Scion9066 2y ago
Generally attestation is not supported outside of enterprise contexts and Apple for example doesn't support it without mobile device management policies being applied to the device. You can make your own backups of passkeys from your password manager. I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators).
- josephcsible 2y ago
  > I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators). The problem is that the protocol allows websites to require use of the latter. If the two were indistinguishable to the website, then passkeys would be a good thing.
madeofpalk 2y ago
I don't believe there's any (public, stable) implementations of it yet, but Secure Credentials Exchange will let you export, transfer, and backup passkeys https://fidoalliance.org/specifications-credential-exchange-specifications https://fidoalliance.org/specifications-credential-exchange-... https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html
- josephcsible 2y ago
  That lets the megacorps make backups for me, but it doesn't let me make my own backups, because they'll only encrypt them to each others' public keys, not mine.
aseipp 2y ago
You're confused. You can use software that doesn't provide backups or clear exports, but attestation is not supported for any widely used websites or WebAuthn software because it defeats synchronization, something pretty much everyone widely considers to be a benefit. It would for example completely negate the ability to synchronize passkeys over something like iCloud, whether or not it had the ability to export keys in a standardized format. Attestation is basically a boondoggle solely for corporations with device management policies, so they can use a standard protocol/framework at the app layer while still enforcing stuff they already enforce. The amount of people in this thread who don't understand the very basics of this stuff is a pretty good counterexample to the common trope they somehow "know better." I kind of doubt that when many people here can't even get the basics straight.
- josephcsible 2y ago
  Couldn't, e.g., Apple implement attestation in such a way that you can move credentials between Apple secure enclaves, but still never export them in a way that you have control over them? That's what I'm worried about.

If the passkey protocol didn't support attestation, then that would be true. But since it does, passkeys aren't as good, since I can't make my own backups of them.

Scion9066 2y ago

Generally attestation is not supported outside of enterprise contexts and Apple for example doesn't support it without mobile device management policies being applied to the device. You can make your own backups of passkeys from your password manager. I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators).

josephcsible 2y ago
> I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators). The problem is that the protocol allows websites to require use of the latter. If the two were indistinguishable to the website, then passkeys would be a good thing.

madeofpalk 2y ago

I don't believe there's any (public, stable) implementations of it yet, but Secure Credentials Exchange will let you export, transfer, and backup passkeys https://fidoalliance.org/specifications-credential-exchange-specifications https://fidoalliance.org/specifications-credential-exchange-... https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html

josephcsible 2y ago
That lets the megacorps make backups for me, but it doesn't let me make my own backups, because they'll only encrypt them to each others' public keys, not mine.

aseipp 2y ago

You're confused. You can use software that doesn't provide backups or clear exports, but attestation is not supported for any widely used websites or WebAuthn software because it defeats synchronization, something pretty much everyone widely considers to be a benefit. It would for example completely negate the ability to synchronize passkeys over something like iCloud, whether or not it had the ability to export keys in a standardized format. Attestation is basically a boondoggle solely for corporations with device management policies, so they can use a standard protocol/framework at the app layer while still enforcing stuff they already enforce. The amount of people in this thread who don't understand the very basics of this stuff is a pretty good counterexample to the common trope they somehow "know better." I kind of doubt that when many people here can't even get the basics straight.

josephcsible 2y ago
Couldn't, e.g., Apple implement attestation in such a way that you can move credentials between Apple secure enclaves, but still never export them in a way that you have control over them? That's what I'm worried about.