6 ms·
For someone who hasn't spent any time thinking about that matter, could you please elaborate your point?
by kleiba 1y ago
For someone who hasn't spent any time thinking about that matter, could you please elaborate your point?
- progval 1y ago"Passkeys are incompatible with open-source software" https://www.smokingonabike.com/2025/01/04/passkey-marketing-is-lying-to-you/ https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
- fragmede 1y agoThen how come KeePassXC has them?
- indigo945 1y agoThe linked blog post explains it. The spec can be implemented by open source software, but the upcoming (or now current?) update to the spec enables attestation, that is, it allows the auth provider to cryptographically verify which implementation the client is using. Under this scheme, auth providers can simply choose to no longer support open source implementations like KeePassXC, and since the spec authors have already claimed that KeePassXC is "non-compliant" because it doesn't ask for a PIN on every auth request, it seems likely that that would happen.
- tadfisher 1y agoAttestation is dead outside of corporate environments. Apple will not implement it except through MDM.
- freedomben 1y agoIsn't PAT apple implementing attestation for everyone?
- GoblinSlayer 1y agoApple will implement it.
- tadfisher 1y agoSource? That is surprising news.
- fragmede 1y agoYes but it seems like KeyPassXC could just ask for PIN on every auth request to satisfy that requirement, without having to close their source.
- reddalo 1y agoWhat if I don't want KeyPassXC to ask me for a PIN every time? I can modify its source code and nobody can stop me.
- pbhjpbhj 1y agoThen your version of KeyPass will not be signed and won't pass TPM checks and so the banking app will refuse to run unless you open the signed version?
- yencabulator 1y agoWhich leads us back full circle to "Passkeys are incompatible with open-source software" from https://news.ycombinator.com/item?id=45090297 https://news.ycombinator.com/item?id=45090297
- dingaling 1y agoImagine using ssh-keygen, but it locks the private key in a vendor-managed secure enclave. You can't copy it, export it, rename it or do anything wth it.
- tadfisher 1y agoI don't just imagine it, I do it, by using gpg-agent as my ssh-agent and using the private key generated by a Yubikey. Another way is to use tpm2-tools so only your laptop running your own signed boot chain can use the key. It is desirable to lock private key material in a physical thing that is hard to steal. You can choose not to do this, and that's fine. Hardware attestation is dead because Apple refuses to implement it, so no one can force you to.
- oigursh 1y agoCan you explain your motivation around gpg-agent and yubikey little more, please? So the private key can't be copied elsewhere?
- tadfisher 1y agoYes, that's the motivation. These days I would explore the TPM option, but I'm worried that has less legal teeth than a physical key if I'm in a law enforcement situation. There's also practicality; I really, really don't want to tell my boss that TSA or whoever had access to the company git repositories and databases for X minutes or hours, and that's sidestepped by checking a bag with the Yubikey (wastes their time) or mailing it to the destination (needs a warrant).