A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for
It doesn’t matter who claims what and who spreads what.
What matters is who controls what, and what they are doing already now with the things they control.
Currently the whole market of mobile OSes (~100%) is controlled by two companies: Apple and Google.
The whole market of desktop OSes (~95% or something like that?) is controlled by three companies: Apple, Google and Microsoft.
Two of them (Apple and Google) already use remote attestation to harm even potential competition and vendorlock consumers to their OSes — Apple through Apple’s App Attest API and Google through Play Integrity API.
Specifically, one of the authenticators — Authy — already bans non-certified devices.
The example is GrapheneOS, because they track and collect and explain this information, but every non-bigtech-governed OS is under threat: all Linux distros, all *BSDs, all mobile Linux distros running Android emulators, LineageOS, Custom ROMs etc.
Now the question: will Apple and Google (and Microsoft and all their other accomplices) not [ab]use passkeys to do exactly the same using yet another piece of technology?
No?
MUAHAHAHAHAHAHAHAHAHAHAHAHA! Naïve child!
Of-fucking-course they will! Gladly, and as soon as they can. You can call this conspiracy, blah-blah-blah, but it’s fucking happening. Already. Just with the different piece of technology. But with the same eternal “yOuR sEcUrItY iS iMpOrTaNt FoR uS” excuse.
Passkeys — WebAuthn — is an amazing technology. Brilliant.
But with one fucking huge problem: a backdoor that 100% will be abused by these assholes.
Who’s using remote attestation for Passkeys? You’re conflating requirements for app signing on Android with an encryption scheme.
I’m not interested in slippery slope arguments, people who use this argument end up arguing against LGBT marriage (they’ll marry dogs next!). Will you? Slippery slope logic says yes.
You’re conflating requirements for app signing on Android with an encryption scheme.
I’m not conflating anything.
Encryption scheme has nothing to do with remote attestation. Passkeys, being not an encryption scheme, but an authentication framework, does, by having it as one of its features.
App signing on Android has nothing to do with the remote attestation. Google Play Integrity Protection, being not an app signing mechanism, but an actual remote attestation mechanism, does.
Both Passkeys framework and Play Integrity Protection can be (and the latter already is) used for market monopolization and consumer vendorlocking.
I’m not interested in slippery slope arguments
You’re free to fuck off far into the distance then.
people who use this argument end up arguing against LGBT marriage (they’ll marry dogs next!). Will you? Slippery slope logic says yes.
And even more so with this kind of offensive and provocative narratives.
Did you even bother to read that first link? It’s just a description of how Passkeys work. Why are you sending me irrelevant garbage like this and wasting my time? Get off that LLM or whatever you’re on, I’m not reading further anything your write. I’m blocking you, goodbye.
It doesn’t matter who claims what and who spreads what.
What matters is who controls what, and what they are doing already now with the things they control.
Currently the whole market of mobile OSes (~100%) is controlled by two companies: Apple and Google.
The whole market of desktop OSes (~95% or something like that?) is controlled by three companies: Apple, Google and Microsoft.
Two of them (Apple and Google) already use remote attestation to harm even potential competition and vendorlock consumers to their OSes — Apple through Apple’s App Attest API and Google through Play Integrity API.
They already extend this even to desktops which they don’t yet fully control (Apple natively, Google through their captcha service): https://grapheneos.social/@GrapheneOS/116550899908879585
The apps already ban non-ceritified devices: https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos
Specifically, one of the authenticators — Authy — already bans non-certified devices.
The example is GrapheneOS, because they track and collect and explain this information, but every non-bigtech-governed OS is under threat: all Linux distros, all *BSDs, all mobile Linux distros running Android emulators, LineageOS, Custom ROMs etc.
Now the question: will Apple and Google (and Microsoft and all their other accomplices) not [ab]use passkeys to do exactly the same using yet another piece of technology?
No?
MUAHAHAHAHAHAHAHAHAHAHAHAHA! Naïve child!
Of-fucking-course they will! Gladly, and as soon as they can. You can call this conspiracy, blah-blah-blah, but it’s fucking happening. Already. Just with the different piece of technology. But with the same eternal “yOuR sEcUrItY iS iMpOrTaNt FoR uS” excuse.
Passkeys — WebAuthn — is an amazing technology. Brilliant.
But with one fucking huge problem: a backdoor that 100% will be abused by these assholes.
Now the questions is: is the security that this truly amazing tech (no sarcasm!) brings worth giving up the [already almost taken from you] control over your digital life?
Who’s using remote attestation for Passkeys? You’re conflating requirements for app signing on Android with an encryption scheme.
I’m not interested in slippery slope arguments, people who use this argument end up arguing against LGBT marriage (they’ll marry dogs next!). Will you? Slippery slope logic says yes.
Microsoft, for example.
I’m not conflating anything.
Encryption scheme has nothing to do with remote attestation. Passkeys, being not an encryption scheme, but an authentication framework, does, by having it as one of its features.
App signing on Android has nothing to do with the remote attestation. Google Play Integrity Protection, being not an app signing mechanism, but an actual remote attestation mechanism, does.
Both Passkeys framework and Play Integrity Protection can be (and the latter already is) used for market monopolization and consumer vendorlocking.
You’re free to fuck off far into the distance then.
And even more so with this kind of offensive and provocative narratives.
Did you even bother to read that first link? It’s just a description of how Passkeys work. Why are you sending me irrelevant garbage like this and wasting my time? Get off that LLM or whatever you’re on, I’m not reading further anything your write. I’m blocking you, goodbye.