3 ms·

> - I write a VS Code extension for plain text passkey storage for simplicity. Do you allow servers to reject this? What should they reject? To oversimplify, th

> - I write a VS Code extension for plain text passkey storage for simplicity. Do you allow servers to reject this? What should they reject? To oversimplify, the corporate folks argue for more control, the open source folks for less. Irrelevant, servers can never control what clients do. The only way to control passkeys is using attestation CAs, which is insanely restrictive (not (just) for the users, but for the implementors), e.g., you only allow Yubikeys, Yubico provisions a TPM guarded endorsement key on the valid keys, and you send an additional challenge that must be signed by the endorsement key and validated by Yubico servers. This is completely, absolutely impractical outside of a closed org that supplies all of its own keys.

conradev 1y ago
How is it "completely, absolutely impractical outside of a closed org" when I thought Google attests every passkey created on Android? https://www.w3.org/TR/webauthn-3/#sctn-android-key-attestation https://www.w3.org/TR/webauthn-3/#sctn-android-key-attestati... Apple would too, if it were not for iCloud Keychain syncing: https://news.ycombinator.com/item?id=43988852 https://news.ycombinator.com/item?id=43988852 My understanding is that servers can block passkeys from insecure Android devices today if they wanted to.
- timmyc123 1y ago
  > How is it "completely, absolutely impractical outside of a closed org" when I thought Google attests every passkey created on Android? Passkeys in Google Password Manager are not attested. There is no known synced passkey credential manager that creates attested passkeys.