But in your mind, those all pale in comparison to what will happen if we all start using passkeys? I'm not buying what you're selling.

Because you appear to be misunderstand what I'm saying. Be careful to not put words in my mouth. I said nothing regarding bans.

I am, however, arguing that a service provider can reject your passkey if they dont like how you manage it, (e.g make it copiable). To access that service using a passkey, you'll have to accept storing your credential on their terms.

And to be clear, I'm in no way blind to the issues with passwords. We've had to tack on a bunch of extras to have password based security keep up, like TOTP, password hashing, recovery methods, phishing resistant tokens, security questions, and so on. I'm not arguing that passwords are perfect; I'm arguing that they preserve the users ultimate control over the credential. I'm totally open and hopeful for improvements to authentication as long as they similarly preserve the user's freedom to manage their credentials as they see fit.

And this may be where the difference in our values shows, since it appears that you view the user's freedom as more of a problem than a boon:

The same special property that allows rampant attacks on the public. I deal with so many people with compromised email inboxes, malware installs, stolen credentials, etc. Passwords are not the end solution to end user security, and I welcome improvements that also simplify UX.

I'm sorry you've had to deal with that, but I simply don't think some users making mistakes justifies allowing a service provider to remove a critical freedom from the user. I dont believe that improved UX and security has to come at the cost of user freedom, but that's what passkeys explicitly allow for by design. I fundamentally disagree with that.

I didn't say [attestation] was tangential. Attestation is for very specific purpose.

Fair enough, I tend to thow it in the same category as "DRM and other gate-keeping technologies" which you did call "tangential." At the end of the day, for the purposes of my argument, they are the same: a service wishes to exert control over how a client runs, and I object to such limitions broadly speaking. The computers I own work for me, not the service. (Of course this changes in enterprises that own their own clients, like the workstations used by their workforce. But even in those situations, however, I would argue that there are generally more effective measures than remote attestation. But I digress...)

I highly doubt any public service would require attested passkeys.

Ah, but how can you be sure? You're missing the guarentee that they can't flip the script on you. The standard allows them to start forcing users to rotate their passwords and passkeys for ones that require attestation of their preferred settings. Maybe it's unlikely, but "unlikely" is still a massive downgrade from "impossible." IMO, it's unacceptable.

Here's another counter-point: Google, Apple, et. al already implement proprietary authentication mechanisms. ...

Just because a standard is open does not mean it isn't rigged in the favor of closed platforms. This is especially the case with passkeys, where platforms use them to further entrench you into their ecosystem, often under the guise of "look how good the UX is!" For example, MacOS really, really wants you to tie your passkeys to their keychain, so that they can control how it's backed up, transferred, and stored. Remote attestation only makes this worse, opening the possibility that a service provider can enforce that you have to use MacOS's keychain. Sounds like a walled garden to me.

Here’s what I don’t get. When I posted this, you were posting every 10 minutes at most defending passkeys. How do you have so much energy and time to defend them so vehemently? Are you heavily invested in a passkey business? Are you an LLM that’s been instructed to defend LLMs at all costs?

I’m not sure the latter is possible since you wrote a large paragraph starting with “it’s easy to say passwords are sufficient” when that has absolutely nothing to do with my opinion on passwords. I suspect an LLM would’ve stuck a little closer to my own words.