3 ms·

Okay, but I don't have that problem with passwords. So passwords have an enormous advantage over Passkeys, in that they don't allow the service to dictate what

Okay, but I don't have that problem with passwords. So passwords have an enormous advantage over Passkeys, in that they don't allow the service to dictate what I can do with my own data.

toomuchtodo 2y ago
Also true, but that's an advantage to you as a byproduct inherent of the primitive, whereas it is a huge disadvantage to enterprises to have to defend against credential spraying and other forms of attack against simple auth factors such as email/username and password string.
- coldpie 2y ago
  Are you willing to sacrifice the entire concept of open source software to gain that? You're really OK requiring everyone on the planet to use exactly three proprietary software vendors' software stacks?
  - toomuchtodo 2y ago
    Am I willing? I personally have no control over the situation at scale as it relates to the rapid uptake in passkeys across major web properties. There is no legal or regulatory mechanism to prevent passkey adoption, and Linux users are so small of a customer population in most circumstances that the loss of them as customers or users is immaterial. On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. Platform and vendor lock in is bad, I do not disagree with you about that point. Blog postings stating "Passkeys bad" is the limit of influence available. The rest of the global user population is going to rapidly adopt through whatever onboarding flows web properties put in front of them to upgrade their creds from passwords to passkeys. I suppose my question back would be "What do you think as an individual you believe you can do about the situation you believe is suboptimal?" https://www.bleepingcomputer.com/news/security/amazon-says-175-million-customers-now-use-passkeys-to-log-in/ https://www.bleepingcomputer.com/news/security/amazon-says-1... ("Amazon says 175 million customers now use passkeys to log in") https://blog.google/technology/safety-security/google-passkeys-update-april-2024/ https://blog.google/technology/safety-security/google-passke... ("In 2022, for World Password Day, we launched passkeys. Today, we’re proud to announce that they have since been used to authenticate users more than 1 billion times across over 400 million Google Accounts.") https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con... ("Convincing a billion users to love passkeys: UX design insights from Microsoft to boost adoption and security") https://state-of-passkeys.io/ https://state-of-passkeys.io/
    - coldpie 2y ago
      Yeah I'm trying to understand the landscape myself. Until I learned about attestation, it seemed like a cool tech and I even spent all morning writing this positive blog post about it. I was really disappointed/hurt to read the spec authors openly not caring about user rights. > On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. It seems like removing the attestation feature from the spec would get us there. > Blog postings stating "Passkeys bad" is the limit of influence available. Yeah. I'm no one special, but I wonder if blog posts from places like the EFF and SFC could get some publicity on the (apparent) fact that Passkeys are an anti-user-freedom technology, just like DRM and TPM are.
      - toomuchtodo 2y ago
        If this is important to you, I would reach out to Senator Wyden's office on the topic [1]. He is a known good advocate of sensible technology policy [2]. Companies do not fear complaints, they fear statute and regulatory requirements. Genuinely wishing you success in your policy advocacy journey on this topic. Pretend you're a lobbyist; you're lobbying for computational freedom gratis. Cory Doctorow might have some helpful advice for you too, his contact info is easy to find. [1] https://www.wyden.senate.gov/ https://www.wyden.senate.gov/ [2] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=wyden&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
        coldpie 2y ago
        Yeah, thanks. I think most likely I'd start by emailing the spec authors in question, since there's a decent chance you & I are misunderstanding something. Maybe a small tweak (like "services shouldn't reject clients without a really, really good reason, like you're authenticating guards at Fort Knox type stuff") would be sufficient to make this a non-issue.

Okay, but I don't have that problem with passwords. So passwords have an enormous advantage over Passkeys, in that they don't allow the service to dictate what I can do with my own data.

toomuchtodo 2y ago

Also true, but that's an advantage to you as a byproduct inherent of the primitive, whereas it is a huge disadvantage to enterprises to have to defend against credential spraying and other forms of attack against simple auth factors such as email/username and password string.

coldpie 2y ago
Are you willing to sacrifice the entire concept of open source software to gain that? You're really OK requiring everyone on the planet to use exactly three proprietary software vendors' software stacks?
- toomuchtodo 2y ago
  Am I willing? I personally have no control over the situation at scale as it relates to the rapid uptake in passkeys across major web properties. There is no legal or regulatory mechanism to prevent passkey adoption, and Linux users are so small of a customer population in most circumstances that the loss of them as customers or users is immaterial. On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. Platform and vendor lock in is bad, I do not disagree with you about that point. Blog postings stating "Passkeys bad" is the limit of influence available. The rest of the global user population is going to rapidly adopt through whatever onboarding flows web properties put in front of them to upgrade their creds from passwords to passkeys. I suppose my question back would be "What do you think as an individual you believe you can do about the situation you believe is suboptimal?" https://www.bleepingcomputer.com/news/security/amazon-says-175-million-customers-now-use-passkeys-to-log-in/ https://www.bleepingcomputer.com/news/security/amazon-says-1... ("Amazon says 175 million customers now use passkeys to log in") https://blog.google/technology/safety-security/google-passkeys-update-april-2024/ https://blog.google/technology/safety-security/google-passke... ("In 2022, for World Password Day, we launched passkeys. Today, we’re proud to announce that they have since been used to authenticate users more than 1 billion times across over 400 million Google Accounts.") https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con... ("Convincing a billion users to love passkeys: UX design insights from Microsoft to boost adoption and security") https://state-of-passkeys.io/ https://state-of-passkeys.io/
  - coldpie 2y ago
    Yeah I'm trying to understand the landscape myself. Until I learned about attestation, it seemed like a cool tech and I even spent all morning writing this positive blog post about it. I was really disappointed/hurt to read the spec authors openly not caring about user rights. > On the record, I do support whatever mechanisms can be implemented via standards to prevent vendor and platform lock in. It seems like removing the attestation feature from the spec would get us there. > Blog postings stating "Passkeys bad" is the limit of influence available. Yeah. I'm no one special, but I wonder if blog posts from places like the EFF and SFC could get some publicity on the (apparent) fact that Passkeys are an anti-user-freedom technology, just like DRM and TPM are.
    - toomuchtodo 2y ago
      If this is important to you, I would reach out to Senator Wyden's office on the topic [1]. He is a known good advocate of sensible technology policy [2]. Companies do not fear complaints, they fear statute and regulatory requirements. Genuinely wishing you success in your policy advocacy journey on this topic. Pretend you're a lobbyist; you're lobbying for computational freedom gratis. Cory Doctorow might have some helpful advice for you too, his contact info is easy to find. [1] https://www.wyden.senate.gov/ https://www.wyden.senate.gov/ [2] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=wyden&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
      - coldpie 2y ago
        Yeah, thanks. I think most likely I'd start by emailing the spec authors in question, since there's a decent chance you & I are misunderstanding something. Maybe a small tweak (like "services shouldn't reject clients without a really, really good reason, like you're authenticating guards at Fort Knox type stuff") would be sufficient to make this a non-issue.