3 ms·

A website could use this feature to require that I only log in using (say) Google or Microsoft or Apple's implementations, right? Under those conditions, how co

A website could use this feature to require that I only log in using (say) Google or Microsoft or Apple's implementations, right? Under those conditions, how could I log in using my Linux desktop?

toomuchtodo 2y ago
That's true. A web property is under no legal or regulatory obligation to ensure you can login with your preferred method or endpoint configuration. This does not apply only to passkeys of course, the web property can always dictate CIAM terms to users. I'd say contact the FTC about this, but I'm unsure how helpful they will be for the next four years.
- coldpie 2y ago
  Okay, but I don't have that problem with passwords. So passwords have an enormous advantage over Passkeys, in that they don't allow the service to dictate what I can do with my own data.
  - toomuchtodo 2y ago
    Also true, but that's an advantage to you as a byproduct inherent of the primitive, whereas it is a huge disadvantage to enterprises to have to defend against credential spraying and other forms of attack against simple auth factors such as email/username and password string.
    - coldpie 2y ago
      Are you willing to sacrifice the entire concept of open source software to gain that? You're really OK requiring everyone on the planet to use exactly three proprietary software vendors' software stacks?
      - toomuchtodo 2y ago
        Am I willing? I personally have no control over the situation at scale as it relates to the rapid uptake in passkeys across major web properties. There is no legal or regulatory mechanism to prevent passkey adoption, and Linux users are so small of a customer population in most circumstances that the loss of them as customers or users is immaterial. On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. Platform and vendor lock in is bad, I do not disagree with you about that point. Blog postings stating "Passkeys bad" is the limit of influence available. The rest of the global user population is going to rapidly adopt through whatever onboarding flows web properties put in front of them to upgrade their creds from passwords to passkeys. I suppose my question back would be "What do you think as an individual you believe you can do about the situation you believe is suboptimal?" https://www.bleepingcomputer.com/news/security/amazon-says-175-million-customers-now-use-passkeys-to-log-in/ https://www.bleepingcomputer.com/news/security/amazon-says-1... ("Amazon says 175 million customers now use passkeys to log in") https://blog.google/technology/safety-security/google-passkeys-update-april-2024/ https://blog.google/technology/safety-security/google-passke... ("In 2022, for World Password Day, we launched passkeys. Today, we’re proud to announce that they have since been used to authenticate users more than 1 billion times across over 400 million Google Accounts.") https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con... ("Convincing a billion users to love passkeys: UX design insights from Microsoft to boost adoption and security") https://state-of-passkeys.io/ https://state-of-passkeys.io/
        coldpie 2y ago
        Yeah I'm trying to understand the landscape myself. Until I learned about attestation, it seemed like a cool tech and I even spent all morning writing this positive blog post about it. I was really disappointed/hurt to read the spec authors openly not caring about user rights. > On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. It seems like removing the attestation feature from the spec would get us there. > Blog postings stating "Passkeys bad" is the limit of influence available. Yeah. I'm no one special, but I wonder if blog posts from places like the EFF and SFC could get some publicity on the (apparent) fact that Passkeys are an anti-user-freedom technology, just like DRM and TPM are.

A website could use this feature to require that I only log in using (say) Google or Microsoft or Apple's implementations, right? Under those conditions, how could I log in using my Linux desktop?

toomuchtodo 2y ago

That's true. A web property is under no legal or regulatory obligation to ensure you can login with your preferred method or endpoint configuration. This does not apply only to passkeys of course, the web property can always dictate CIAM terms to users. I'd say contact the FTC about this, but I'm unsure how helpful they will be for the next four years.

coldpie 2y ago
Okay, but I don't have that problem with passwords. So passwords have an enormous advantage over Passkeys, in that they don't allow the service to dictate what I can do with my own data.
- toomuchtodo 2y ago
  Also true, but that's an advantage to you as a byproduct inherent of the primitive, whereas it is a huge disadvantage to enterprises to have to defend against credential spraying and other forms of attack against simple auth factors such as email/username and password string.
  - coldpie 2y ago
    Are you willing to sacrifice the entire concept of open source software to gain that? You're really OK requiring everyone on the planet to use exactly three proprietary software vendors' software stacks?
    - toomuchtodo 2y ago
      Am I willing? I personally have no control over the situation at scale as it relates to the rapid uptake in passkeys across major web properties. There is no legal or regulatory mechanism to prevent passkey adoption, and Linux users are so small of a customer population in most circumstances that the loss of them as customers or users is immaterial. On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. Platform and vendor lock in is bad, I do not disagree with you about that point. Blog postings stating "Passkeys bad" is the limit of influence available. The rest of the global user population is going to rapidly adopt through whatever onboarding flows web properties put in front of them to upgrade their creds from passwords to passkeys. I suppose my question back would be "What do you think as an individual you believe you can do about the situation you believe is suboptimal?" https://www.bleepingcomputer.com/news/security/amazon-says-175-million-customers-now-use-passkeys-to-log-in/ https://www.bleepingcomputer.com/news/security/amazon-says-1... ("Amazon says 175 million customers now use passkeys to log in") https://blog.google/technology/safety-security/google-passkeys-update-april-2024/ https://blog.google/technology/safety-security/google-passke... ("In 2022, for World Password Day, we launched passkeys. Today, we’re proud to announce that they have since been used to authenticate users more than 1 billion times across over 400 million Google Accounts.") https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con... ("Convincing a billion users to love passkeys: UX design insights from Microsoft to boost adoption and security") https://state-of-passkeys.io/ https://state-of-passkeys.io/
      - coldpie 2y ago
        Yeah I'm trying to understand the landscape myself. Until I learned about attestation, it seemed like a cool tech and I even spent all morning writing this positive blog post about it. I was really disappointed/hurt to read the spec authors openly not caring about user rights. > On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. It seems like removing the attestation feature from the spec would get us there. > Blog postings stating "Passkeys bad" is the limit of influence available. Yeah. I'm no one special, but I wonder if blog posts from places like the EFF and SFC could get some publicity on the (apparent) fact that Passkeys are an anti-user-freedom technology, just like DRM and TPM are.