189
Passkeys may require some more research. (lemmy.zip)
submitted 13 hours ago by to c/linux@lemmy.ml
83 comments fedilink hide all child comments
 

you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 11 hours ago* (2 children)

I think the reason passkeys are so controversial is that tech has a long history of ignoring user choice and pushing the most anti ownership solutions possible. Therefore, I think there is fair concern emerging along with any new mechanism that has any sort of TPM or hardware attestation components at all.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 10 hours ago* (last edited 10 hours ago) (1 child)

    The concern is valid, but we should also look at these company's interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.

    The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven't locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.

    If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven't done so for TOTP.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 9 hours ago*

    If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven't done so for TOTP.

    Didn’t you already answer this by saying they want to increase adoption? That seems like the reason. I think the argument here is the same as what they do with something like streaming (which is closer to what I have a problem with, rather than locking people to specific software). They work on adoption until the numbers and ease of use are high enough to kill the other options and prevent multiple people from logging into one account. They lose some people, but gain more because of the new restrictions forcing people to have their own account.

    Doesn’t necessarily work the same in that sense, but it’s still a numbers game. We continuously see companies/governments postpone onerous policies until they have enough people willing to put up with it. Then they ram it through and ignore the people that complain. It’s age gating and digital only purchases and digital id and backdoors and everything else we see with tech.

  • permalink
  • fedilink
  • source
  • parent