you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 2 days ago (1 child)

It wouldn’t be a silent ratchet though. Attestations require a hardware-backed passkey, which makes them non-transferable. And you can’t convert a software-backed passkey into a hardware-backed passkey. So if your passkey is stored by a password manager that syncs, you’re good.

[Okay, technically it doesn’t have to be hardware-backed to be attested. But if it’s software-backed the attestation becomes of such low quality that it’s not accomplishing the goal anymore. When a device attests that the passkey is coming from device X running OS Y, but that exact same passkey is also synced to other devices running other OSes, the server loses most of the reason to trust that attestation.]

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 2 days ago

    The second half of your comment is basically what big tech companies do for a living.

    What's the point of half of the software standards they proposed, and bribed officials to accept them without addressing issues?

    There is no point, other than money.

  • source
  • parent