410
I don't like passkeys | Ethan Hawksley (hawksley.dev)
submitted 1 week ago by to c/technology@lemmy.world
171 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 90 points 1 week ago (2 children)

Sadly did not dig into the whole "the other side decides which device you are allowed to use" topic, a feature inherently build into passkeys.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 17 points 1 week ago (1 child)

    I think that is only an issue based on what Passkey attestation is configured by the relying party? From what I have read a lot of public facing companies implementing it will have passkey attestation statements configured as None, which typically means there isn't an authenticator certificate verification.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 1 week ago

    Only companies issuing their own passkeys on company hardware has a reason to enable attestation (forcing use of company approved devices throughout). Any public facing service has no reason to use attestation.

  • permalink
  • fedilink
  • source
  • parent