A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for
The passkeys most people use are synced passkeys, stored in iCloud Keychain, Google Password Manager, 1Password, Bitwarden or whatever other software of your choosing. These passkeys don’t give websites an attestation statement at all, and though a site can ask, what comes back is none.
This changes with… ~1 AI prompt by each of the password managers.
And if someone as big as Google tomorrow says “for ‘security reasons’, in 3 months we allow passkeys only from the apps that provide attestation” (and they 100% will do that at some point, there’s not even 0.0001% chance that they won’t do it as soon as the timing will be favourable for them), then all of these above will implement attestation statement the very next week.
If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?
Google. They don’t give a fuck. Because they have an enormous leverage to make all major password managers comply the very next week.
And then, after Google, once support is there, everyone else.
Besides, the guidance for consumer sites has been to not even request attestation for years now.
Nobody cares. Vendorlocking you is in their interest (their = mostly bigtech ofc, not fediverse, obv), so they’ll do it.
Attestation Isn’t What You Think It Is
The post describes attestation as proving “that an approved passkey manager, operating system, and firmware are in use” which is simply not true.
When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
Summing up, remote attestation is a horrible anti-consumer piece of crap, the main purpose of which (in the context of bigtech) is to vendorlock the users to a few very specific hardware-software stacks fully under control of a very few companies.
The only things that stands between bigtech and fully vendorlocking you are passkeys adoption and the share of non-bigtech-controlled devices + OSes + password managers.
Given that “normies” don’t give a flying fuck about using privacy-respecting tech stacks which results in 99% adoption of Apple/Google/Microsoft triopoly, it, unfortunately, reduces the defence against such vendorlocking to passkeys adoption only ¯\_(ツ)_/¯
This is a very slippery slope kind of argument and you’re arguing with people working on Passkeys who likely know how they work.
If you’re a fan of conspiracy theories consider this comment from the discussion linked above:
Let’s just put out a counter conspiracy theory here. There are people who benefit from phishing. There’s a whole crime-as-a-service industry out there. So who would benefit from spreading FUD about passkeys? Qui bono? Exactly!
It doesn’t matter who claims what and who spreads what.
What matters is who controls what, and what they are doing already now with the things they control.
Currently the whole market of mobile OSes (~100%) is controlled by two companies: Apple and Google.
The whole market of desktop OSes (~95% or something like that?) is controlled by three companies: Apple, Google and Microsoft.
Two of them (Apple and Google) already use remote attestation to harm even potential competition and vendorlock consumers to their OSes — Apple through Apple’s App Attest API and Google through Play Integrity API.
Specifically, one of the authenticators — Authy — already bans non-certified devices.
The example is GrapheneOS, because they track and collect and explain this information, but every non-bigtech-governed OS is under threat: all Linux distros, all *BSDs, all mobile Linux distros running Android emulators, LineageOS, Custom ROMs etc.
Now the question: will Apple and Google (and Microsoft and all their other accomplices) not [ab]use passkeys to do exactly the same using yet another piece of technology?
No?
MUAHAHAHAHAHAHAHAHAHAHAHAHA! Naïve child!
Of-fucking-course they will! Gladly, and as soon as they can. You can call this conspiracy, blah-blah-blah, but it’s fucking happening. Already. Just with the different piece of technology. But with the same eternal “yOuR sEcUrItY iS iMpOrTaNt FoR uS” excuse.
Passkeys — WebAuthn — is an amazing technology. Brilliant.
But with one fucking huge problem: a backdoor that 100% will be abused by these assholes.
Who’s using remote attestation for Passkeys? You’re conflating requirements for app signing on Android with an encryption scheme.
I’m not interested in slippery slope arguments, people who use this argument end up arguing against LGBT marriage (they’ll marry dogs next!). Will you? Slippery slope logic says yes.
You’re conflating requirements for app signing on Android with an encryption scheme.
I’m not conflating anything.
Encryption scheme has nothing to do with remote attestation. Passkeys, being not an encryption scheme, but an authentication framework, does, by having it as one of its features.
App signing on Android has nothing to do with the remote attestation. Google Play Integrity Protection, being not an app signing mechanism, but an actual remote attestation mechanism, does.
Both Passkeys framework and Play Integrity Protection can be (and the latter already is) used for market monopolization and consumer vendorlocking.
I’m not interested in slippery slope arguments
You’re free to fuck off far into the distance then.
people who use this argument end up arguing against LGBT marriage (they’ll marry dogs next!). Will you? Slippery slope logic says yes.
And even more so with this kind of offensive and provocative narratives.
Did you even bother to read that first link? It’s just a description of how Passkeys work. Why are you sending me irrelevant garbage like this and wasting my time? Get off that LLM or whatever you’re on, I’m not reading further anything your write. I’m blocking you, goodbye.
Arguments against Flock and how it’s used specifically are based on reality, not the slippery slope. Flock-like solutions are deployed in many places (and even mandated by EU) without much outrage. Automated car surveillance is a good thing in general and segmental speed measurement is great at increasing road safety.
This changes with… ~1 AI prompt by each of the password managers.
And if someone as big as Google tomorrow says “for ‘security reasons’, in 3 months we allow passkeys only from the apps that provide attestation” (and they 100% will do that at some point, there’s not even 0.0001% chance that they won’t do it as soon as the timing will be favourable for them), then all of these above will implement attestation statement the very next week.
Google. They don’t give a fuck. Because they have an enormous leverage to make all major password managers comply the very next week.
And then, after Google, once support is there, everyone else.
Nobody cares. Vendorlocking you is in their interest (their = mostly bigtech ofc, not fediverse, obv), so they’ll do it.
This whole section is outright wrong. The very idea behind attestation is to bind the key pair to the hardware device through a chain of trust. See https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion for how it actually works.
Summing up, remote attestation is a horrible anti-consumer piece of crap, the main purpose of which (in the context of bigtech) is to vendorlock the users to a few very specific hardware-software stacks fully under control of a very few companies.
The only things that stands between bigtech and fully vendorlocking you are passkeys adoption and the share of non-bigtech-controlled devices + OSes + password managers.
Given that “normies” don’t give a flying fuck about using privacy-respecting tech stacks which results in 99% adoption of Apple/Google/Microsoft triopoly, it, unfortunately, reduces the defence against such vendorlocking to passkeys adoption only ¯\_(ツ)_/¯
This is a very slippery slope kind of argument and you’re arguing with people working on Passkeys who likely know how they work.
If you’re a fan of conspiracy theories consider this comment from the discussion linked above:
It doesn’t matter who claims what and who spreads what.
What matters is who controls what, and what they are doing already now with the things they control.
Currently the whole market of mobile OSes (~100%) is controlled by two companies: Apple and Google.
The whole market of desktop OSes (~95% or something like that?) is controlled by three companies: Apple, Google and Microsoft.
Two of them (Apple and Google) already use remote attestation to harm even potential competition and vendorlock consumers to their OSes — Apple through Apple’s App Attest API and Google through Play Integrity API.
They already extend this even to desktops which they don’t yet fully control (Apple natively, Google through their captcha service): https://grapheneos.social/@GrapheneOS/116550899908879585
The apps already ban non-ceritified devices: https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos
Specifically, one of the authenticators — Authy — already bans non-certified devices.
The example is GrapheneOS, because they track and collect and explain this information, but every non-bigtech-governed OS is under threat: all Linux distros, all *BSDs, all mobile Linux distros running Android emulators, LineageOS, Custom ROMs etc.
Now the question: will Apple and Google (and Microsoft and all their other accomplices) not [ab]use passkeys to do exactly the same using yet another piece of technology?
No?
MUAHAHAHAHAHAHAHAHAHAHAHAHA! Naïve child!
Of-fucking-course they will! Gladly, and as soon as they can. You can call this conspiracy, blah-blah-blah, but it’s fucking happening. Already. Just with the different piece of technology. But with the same eternal “yOuR sEcUrItY iS iMpOrTaNt FoR uS” excuse.
Passkeys — WebAuthn — is an amazing technology. Brilliant.
But with one fucking huge problem: a backdoor that 100% will be abused by these assholes.
Now the questions is: is the security that this truly amazing tech (no sarcasm!) brings worth giving up the [already almost taken from you] control over your digital life?
Who’s using remote attestation for Passkeys? You’re conflating requirements for app signing on Android with an encryption scheme.
I’m not interested in slippery slope arguments, people who use this argument end up arguing against LGBT marriage (they’ll marry dogs next!). Will you? Slippery slope logic says yes.
Microsoft, for example.
I’m not conflating anything.
Encryption scheme has nothing to do with remote attestation. Passkeys, being not an encryption scheme, but an authentication framework, does, by having it as one of its features.
App signing on Android has nothing to do with the remote attestation. Google Play Integrity Protection, being not an app signing mechanism, but an actual remote attestation mechanism, does.
Both Passkeys framework and Play Integrity Protection can be (and the latter already is) used for market monopolization and consumer vendorlocking.
You’re free to fuck off far into the distance then.
And even more so with this kind of offensive and provocative narratives.
Did you even bother to read that first link? It’s just a description of how Passkeys work. Why are you sending me irrelevant garbage like this and wasting my time? Get off that LLM or whatever you’re on, I’m not reading further anything your write. I’m blocking you, goodbye.
And criminals would also want to spread “FUD” about Flock Surveillance and other beacons of Safety and Security, those damned scoundrels
Arguments against Flock and how it’s used specifically are based on reality, not the slippery slope. Flock-like solutions are deployed in many places (and even mandated by EU) without much outrage. Automated car surveillance is a good thing in general and segmental speed measurement is great at increasing road safety.
I couldn’t disagree more. A surveillance state is bad, no matter which authoritarian or collective of authoritarians holds the reins.
“For our security” and “for the children” are the two excuses fascists use to excuse destruction of privacy and human rights in general
I mean, we already have it. Wherever it’s rolled out drivers start to behave which measurably saves lives.