> at login time it's not possible to retroactively require attestation if it wasn't obtained during registration.

Of course it is, the site will reject the passkey and require you to create one that is attested.

> Are Netflix and Twitter currently requesting attestation when people register passkeys, and rejecting the registration if the user declines the permission prompt?

They could start tomorrow.

> a hypothetical and unlikely scenario.

You have not been paying attention, that scenario is where this whole thing is building towards.

> If consumer-facing sites start requesting attestation when registering passkeys, they deserve to be vigorously called out

It's going to be the banks first.

Why called out, it's all for your safety, to make sure you are not using an insecure client that might leak your data.

▲

somerandom2407 3 hours ago | parent | next [-]

Any site/service could easily implement their own proprietary solution to force compliance around usage of said service. Whether they can abuse Passkeys or not is irrelevant. If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.

To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater. All of these features of Passkeys are appropriate in a given context. The only concern is where a service that might not need/justify "high security" Passkeys starts demanding them anyway, and no-one is forcing you to use said service in that case.

▲

skulk 2 hours ago | parent | next [-]

Any government can spy on a few people, and we're generally fine with that. But when they build a robust network of surveillance devices but pinky promise that they're only being used to spy on those same few people, we bring out the electric saws. It's a very similar situation with normalizing passkeys.

	▲	somerandom2407 an hour ago \| parent [-]
		The concern you're raising here is that the government might secretly force big companies like Facebook or Google to require attested passkeys that restrict usage to only approved first-party keystores right? Passkeys exist now and there's no taking them back. However, even if they did not, the government might well just develop its own authentication system and require that it be used under policies that require age verification for social media, for example. Hell, they might end up doing that anyway, and that would be no different. If the government wants to force tracking/verification on certain websites, it won't simply be something they walk away from if Passkeys don't exist. You can only fight this with your vote and by not using those services once they implement such controls.

▲

throwawayffffas 2 hours ago | parent | prev | next [-]

I kind of agree, the problem is not individual sites consuming passkeys.

The main problem in my mind is on the side of the vendors, attestation, secure hardware, etc is all an excuse to lock you in to their device/ecosystem.

▲

devsda 2 hours ago | parent | prev [-]

> If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.

Like how everyone stopped using Google/Gmail, Facebook/Instagram and Windows/Office365 and flocked to alternatives?

Let's flip your suggestion. What if someone says if you need "high security" build a competing service that enforces it, no one is forcing you to use a "low security" service ?

▲

somerandom2407 an hour ago | parent [-]

The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything.

My point was not about getting critical mass, it's that the service can already do anything they like to lock people into whatever they want and gatekeep their service. They can do it with Passkeys, or they can do it with a proprietary alternative and if they're big enough, they'll get away with it. Neither of us can sway them at all - I wasn't saying they should do this, only that they can.

Blaming Passkeys is aiming at the wrong target. Passkeys rightly offer features that have valid use-cases, even the attestation in the right context. Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not.

	▲	devsda 9 minutes ago \| parent [-]
		> Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not. Let the usecases that need passkeys use it. Why can't there be a parallel standard with similar features that doesn't have the parts that can potentially be abused. If the difference between abuse and non-abuse is a vague promise and the good graces of corporate structures, it is better to err on the side of caution and demand solutions that make it impossible. > The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything. Yeah it wasn't your place or anyone else's. Debate is how we evolve new and alternate solutions. Handwaving by saying not your place or mine is not how we affect change if needed.

▲

supertrope 3 hours ago | parent | prev | next [-]

Banks want attested terminals and for the customer to pay for them. An even better deal for the bank than ATMs, kind of like of how cable TV boxes enforce DRM on the customer and are paid for by the customer.

▲

agwa 4 hours ago | parent | prev | next [-]

So they're gonna stop supporting Apple users?

▲

throwawayffffas 4 hours ago | parent [-]

Nah, Apple is going to provide attestation, and since you can't or won't be able to share keys between accounts, no harm no foul.

▲

EA-3167 3 hours ago | parent [-]

For a lot of people Apple is the ecosystem they access everything through, including payment processing. That cuts both ways, but Apple has shown a clear preference for protecting user privacy when they could have chosen to do otherwise, presumably because it makes them more money in the long run.

Why would that suddenly change in Netflix or some other company's favor at Apple's direct expense?

▲

throwawayffffas 3 hours ago | parent [-]

It's not in Apples expense, it's actually in it's benefit, your keys would be in their system, and impossible for anyone (including you) to get them out of it.

So you are now locked in to the apple ecosystem forever. You now need Apple to watch Netflix from your Samsung TV.

▲

WorldMaker an hour ago | parent | next [-]

Apple has very good support for Passkey storage in third party password managers/wallets. They don't seem to want Passkeys to be a lock in. They've also made it clear that they see attestation as a consumer privacy violation and won't support it.

▲

EA-3167 3 hours ago | parent | prev [-]

You make it sound like Apple needs to lock the door instead of just opening it while everyone else shoots themselves in the foot. For people who want "it just works" as the highest function of their device, nothing comes close to Apple. It's only people with a technical inclination or specific needs who chaff at that, or people like me who are just cranky old bastards who don't want their own media collection apart from i/Apple/Everything.

But man... I cannot tell you how many people don't even notice the walls of the garden. Besides Apple is in competition with some huge players, more than capable of offering "Done with Apple literally trapping you? Follow this link and we'll transfer your passkeys."

	▲	makeitdouble 16 minutes ago \| parent \| next [-]
		> "it just works" That ship has sailed a long time ago. Most people still hanging to that part have already built a whole way of life around the Apple ecosystem and the boundaries and how to work around them have become second nature to them. The iPhone is now near 20y old, the world also changed, most got enshitificated, and looking at kids and elderlies dealing with their iPhones and macs none of it "just works". Looking at Japan, it was the bastion of iPhone predominance, but I'm the latest numbers 30+ yo gradually got off the train to move to android as their phone is just becoming another tool to them.
	▲	throwawayffffas 3 hours ago \| parent \| prev [-]
		> Done with Apple literally trapping you? Follow this link and we'll transfer your passkeys. That's the whole point of the FIDO specs. This is now literally impossible to do. All the vendors are weirdly okay with this I believe it's because it cuts both ways.

▲

MBCook an hour ago | parent | prev [-]

We have more than enough technology in browsers to allow JavaScript reading live video from your webcam. A website could use that so they can see if you’re looking at the ads enough.

They could start doing it tomorrow. They just have to flip the switch.

What’s your point?