4 ms·
The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could gen
by xvilka 2mo ago
The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proofs for particular properties (e.g. if the person has a driver license or not) without de-anonymizing the account. In the rare even of root key leak you should be able to physically go to the authority and make a new one, while revoking the old key. I don't see any other better alternatives than this.
- giancarlostoro 2mo agoPasskey?
- gonzalohm 2mo agoI think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)
- vincnetas 2mo agoI think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.
- gonzalohm 2mo agoI think you can but it has to be supported by the website that you are using
- cassianoleal 2mo agoI don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.
- gonzalohm 2mo agoDoesn't that defeat the purpose? I thought the objective was to get rid of passwords
- ChrisMarshallNY 2mo agoI use passkeys only, for the backend admin app for my app. They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else. Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch. I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password. A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/ https://littlegreenviper.com/series/passkeys/
- jerf 2mo agoMy passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them. It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though. Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.
- jeroenhd 2mo agoYes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden). Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default. As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.
- iamnothere 2mo agoThere are even open source hardware passkeys (NitroKey) so you can have security with freedom.
- FireBeyond 2mo ago> Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default. Assuming the FIDO Consortium approves. Otherwise you might be like KeePass, being unceremoniously threatened with revocation of attestation, for offering to do what the big players are able to do.
- giancarlostoro 2mo agoMy passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it. When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.
- krrrh 2mo agoBluetooth is actually only used to establish proximity. Both your phone and the browser connect to an internet relay, which lets the phone essentially pretend to be a USB security key connected to the computer.
- duskdozer 2mo agoYou can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.
- ExoticPearTree 2mo ago> think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account) It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devices. There are cases though, where the website can force the requirement of a device bound passkey, but that is something it is not very likely you will encounter.
- gonzalohm 2mo agoBut you don't own your passkey. That's the biggest red flag. It's yet another wall by apple to prevent you from leaving their ecosystem
- ChrisMarshallNY 2mo agoI think the OS is needed to sign the challenge, but the private key can be taken wherever. And passkeys are multiplatform. Not Apple-only, by a long shot. And I suspect that most geeks, hereabouts, could set up their own signing system.
- vablings 2mo agoI have considered making a website that specifically enforces the use of a hardware passkey such as a yubikey since you can verify that it it is a real device signed by yubico meaning that if you want a bunch of users to come discuss a subject they are verified by means of having to purchase a physical key. Obviously, there is nothing stopping someone from buying a bunch of yubikeys but you can then ban said users with those yubikeys
- grebc 2mo agoI don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.
- lima 2mo agoeID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs. Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem. Doesn't even need ZKP, the CA can just issue an attestation.
- maratc 2mo agoI've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere. So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.
- pas 2mo agoyes, just as age verification can be fooled by an older friend who gets the check mark.
- maratc 2mo agoReminds me of If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography. (Bruce Schneier dug into origins of this here: https://www.schneier.com/blog/archives/2026/05/laurie-anderson-is-quoting-me.html https://www.schneier.com/blog/archives/2026/05/laurie-anders...)
- 2mo ago
- smalltorch 2mo agoThat sounds like this prediction from 2003 https://www.fourmilab.ch/documents/digital-imprimatur/#SI_anonymous_ID https://www.fourmilab.ch/documents/digital-imprimatur/#SI_an...
- doikor 2mo agoThis is effectively the EU age verification system. Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the certs.
- nwlieb 2mo agoThe EU age verification system requires tying yourself to Google/Apple [0] (ie will not work with GrapheneOS) which is a non-starter. This means you will need a mandatory Google/Apple account. What if your Google account gets banned? [0] https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/discussions/19 https://github.com/eu-digital-identity-wallet/av-doc-technic...
- FireBeyond 2mo agoMy Google account is in good standing but has other issues. In between startups and side projects I cannot link my phone number as it has been used "too many times". So apparently, to Google, if I want a new account or to set this up, I need a new phone number. Enquiries to support have gone as well as you'd expect with Google.
- troupo 2mo agoI have a gradfathered account from before Google Workspaces or whatever its name (Google Apps for Domains?) became a paid service, and it's in an extremely weird state after so many changes to what Google offers, integrates, fixes and unfixes, that I sometimes can't even login to Google services. Ended up moving my mail and info from Google away, just not to deal with it.
- mixdup 2mo agoThe problem in the US is that the government doesn't necessarily have all of your details. Most people's ID is a driver's license, but you're not mandated to have one of those. The federal government doesn't control those databases (hi, REAL ID), and few people actually have passports. Your citizenship documents are just a birth certificate that is an image on file with a particular state's health department. A centralized identification system on that scale in the US would take generations to get up and running
- chr15m 2mo ago> the most you lose Yep that's the only thing you lose, apart from a huge number of literal images of kids in the hands of literal criminals. > I don't see any other better alternatives Not doing age verification!
- micromacrofoot 2mo agoage verification is the current mandate of multiple governments, not doing it for many services means shutting down
- chr15m 2mo agoI don't mean the services I mean the governments.