3 ms·
"A third party OAuth provider puts you at the mercy of the service provider" This is they key issue with trusting a third party to manage my passkeys, they can
by UltraSane 15d ago
"A third party OAuth provider puts you at the mercy of the service provider" This is they key issue with trusting a third party to manage my passkeys, they can also BLOCK them and lock me out. An exception is if the passkeys are synced to all your devices and cannot be remotely wiped. I think this is how Apple works.
- iamnothere 15d agoI didn’t think of this in the moment, but you’re right, this is an even bigger risk than compromise. There’s regularly a thread here about someone getting locked out of their cloud accounts, and now we’re going to gate everything behind those same accounts? Horrible idea.
- lxgr 15d agoYes, I'd absolutely not use Apple or Google for my passkeys, even though they now at least seem to support exporting them to other platforms.
- lxgr 15d agoThen don't, there are several open source synchronizing passkey implementations!