3 ms·

Device attestation is how you can use private keys you don't actually have access to. It has a lot of value to literally anyone who wants to store tokens or use

Device attestation is how you can use private keys you don't actually have access to. It has a lot of value to literally anyone who wants to store tokens or use one time authentication codes. Linux folks need to implement the full stack and offer an open alternative to payments, secrets, and tokens. In the age of LLMs there is no excuse. It is annoying as hell that I can't buy a System76 or Framework laptop with a fingerprint sensor but a Lenovo comes with one that works on Linux perfectly.

sophrosyne42 2mo ago
Framework has a fingerprint sensor. [1] [1] https://frame.work/products/fingerprint-reader-kit?v=FRANTD0001 https://frame.work/products/fingerprint-reader-kit?v=FRANTD0...
- hparadiz 2mo ago
  It needs to come stock on every Linux laptop from now going forward period. Like you expect a screen to come with your machine. Every Mac has one now and I'm not going back to typing my password in every single time.
- jeroenhd 2mo ago
  Lots of laptop vendors do. Very few integrate fingerprint scanners into any kind of secure authentication flow, though. There are decent fingerprint drivers for various brands, but connecting fingerprints to authentication beyond basic login requires manual setup. You don't actually need biometrics to use key material, that's what (f)TPMs are for. They're not set up to be usable out of the box in any Linux distro I've tried, though.
  - sophrosyne42 2mo ago
    That's more of a problem on the distro side, no?
dingaling 2mo ago
"Device attestation is how you can use private keys you don't actually have access to." Read that phrase back and then ask "is this the future of computing that we wanted?" The likes of passkeys, essentially user-hostile ssh keys that live on your device but aren't accessible by you, would have been an unbelievable dystopia to us in the 90s. "Linux folks need to implement the full stack" Nah it's fine thanks, I'd rather opt out of corporate serfdom than compromise my principles.
- hparadiz 2mo ago
  That's just your opinion. Has nothing to do with Linux. And yes I would like a device like a soldered in tpm device that can generate private keys and verify signatures signed with the public key. Your misunderstanding of the technology not withstanding it does appear to me to be quite a valuable technology since it's in basically every computer these days. Stop speaking for Linux.
- rstuart4133 2mo ago
  > Read that phrase back and then ask "is this the future of computing that we wanted?" It is what I want. If you own a mobile phone it's unavoidable. The physical SIM is a guarded area with secrets you can't know or touch - the secrets it holds prove you paid for access to their network. If you want to carry a zillion others devices you can't access the innards of that prove something about you then good for you. But don't assume the rest of us think that's a good idea. We no more object to carving out a little bit of firewalled memory for the exclusive use of the bank than we object to the electricity meter in our houses. It's also a locked down piece of equipment we can't modify or touch that lives on our property. Most people are happy to grant that intrusion on their personal space in exchange for having the electrity connected. It's no different on your phone. In return for your phone protecting its details from you, you no longer have to carry a credit card, or driver's licence, or prove you paid for ads to go away in some app, or access your works VPN. I honestly can't see much difference between carrying a credit card the hides some information from me, or putting the same info in the phone and it hiding the info. Except for having one less device to haul around, of course.

sophrosyne42 2mo ago

Framework has a fingerprint sensor. [1] [1] https://frame.work/products/fingerprint-reader-kit?v=FRANTD0001 https://frame.work/products/fingerprint-reader-kit?v=FRANTD0...

hparadiz 2mo ago
It needs to come stock on every Linux laptop from now going forward period. Like you expect a screen to come with your machine. Every Mac has one now and I'm not going back to typing my password in every single time.
jeroenhd 2mo ago
Lots of laptop vendors do. Very few integrate fingerprint scanners into any kind of secure authentication flow, though. There are decent fingerprint drivers for various brands, but connecting fingerprints to authentication beyond basic login requires manual setup. You don't actually need biometrics to use key material, that's what (f)TPMs are for. They're not set up to be usable out of the box in any Linux distro I've tried, though.
- sophrosyne42 2mo ago
  That's more of a problem on the distro side, no?

dingaling 2mo ago

"Device attestation is how you can use private keys you don't actually have access to." Read that phrase back and then ask "is this the future of computing that we wanted?" The likes of passkeys, essentially user-hostile ssh keys that live on your device but aren't accessible by you, would have been an unbelievable dystopia to us in the 90s. "Linux folks need to implement the full stack" Nah it's fine thanks, I'd rather opt out of corporate serfdom than compromise my principles.

hparadiz 2mo ago
That's just your opinion. Has nothing to do with Linux. And yes I would like a device like a soldered in tpm device that can generate private keys and verify signatures signed with the public key. Your misunderstanding of the technology not withstanding it does appear to me to be quite a valuable technology since it's in basically every computer these days. Stop speaking for Linux.
rstuart4133 2mo ago
> Read that phrase back and then ask "is this the future of computing that we wanted?" It is what I want. If you own a mobile phone it's unavoidable. The physical SIM is a guarded area with secrets you can't know or touch - the secrets it holds prove you paid for access to their network. If you want to carry a zillion others devices you can't access the innards of that prove something about you then good for you. But don't assume the rest of us think that's a good idea. We no more object to carving out a little bit of firewalled memory for the exclusive use of the bank than we object to the electricity meter in our houses. It's also a locked down piece of equipment we can't modify or touch that lives on our property. Most people are happy to grant that intrusion on their personal space in exchange for having the electrity connected. It's no different on your phone. In return for your phone protecting its details from you, you no longer have to carry a credit card, or driver's licence, or prove you paid for ads to go away in some app, or access your works VPN. I honestly can't see much difference between carrying a credit card the hides some information from me, or putting the same info in the phone and it hiding the info. Except for having one less device to haul around, of course.