4 ms·
The problem with this is requiring everyone to own a device with a secure enclave or similar hardware capabilities because some people are prone to being phishe
by bgbntty2 10mo ago
The problem with this is requiring everyone to own a device with a secure enclave or similar hardware capabilities because some people are prone to being phished. Let me choose the level of risk I find acceptable.
- stavros 10mo agoPasskeys don't require this.
- bgbntty2 10mo agoHow else would you make the private key unexportable and the passkey uncopyable?
- stavros 10mo agoYou wouldn't, and still passkeys don't require this.
- bgbntty2 10mo ago[dead]
- coldpie 10mo agoPasskeys don't require it, but relying-parties may: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994182200 https://github.com/keepassxreboot/keepassxc/issues/10407#iss... If enough RPs ban clients that let users manage their own data in the name of "security," then it is effectively required by passkeys. The passkey spec could have been written to be resilient against this type of abuse, but instead this abuse is explicitly considered a feature of the spec.