Any site/service could easily implement their own proprietary solution to force compliance around usage of said service. Whether they can abuse Passkeys or not is irrelevant. If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.

To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater. All of these features of Passkeys are appropriate in a given context. The only concern is where a service that might not need/justify "high security" Passkeys starts demanding them anyway, and no-one is forcing you to use said service in that case.

▲

skulk 3 hours ago | parent | next [-]

Any government can spy on a few people, and we're generally fine with that. But when they build a robust network of surveillance devices but pinky promise that they're only being used to spy on those same few people, we bring out the electric saws. It's a very similar situation with normalizing passkeys.

	▲	somerandom2407 an hour ago \| parent [-]
		The concern you're raising here is that the government might secretly force big companies like Facebook or Google to require attested passkeys that restrict usage to only approved first-party keystores right? Passkeys exist now and there's no taking them back. However, even if they did not, the government might well just develop its own authentication system and require that it be used under policies that require age verification for social media, for example. Hell, they might end up doing that anyway, and that would be no different. If the government wants to force tracking/verification on certain websites, it won't simply be something they walk away from if Passkeys don't exist. You can only fight this with your vote and by not using those services once they implement such controls.

▲

throwawayffffas 2 hours ago | parent | prev | next [-]

I kind of agree, the problem is not individual sites consuming passkeys.

The main problem in my mind is on the side of the vendors, attestation, secure hardware, etc is all an excuse to lock you in to their device/ecosystem.

▲

devsda 2 hours ago | parent | prev [-]

> If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.

Like how everyone stopped using Google/Gmail, Facebook/Instagram and Windows/Office365 and flocked to alternatives?

Let's flip your suggestion. What if someone says if you need "high security" build a competing service that enforces it, no one is forcing you to use a "low security" service ?

▲

somerandom2407 an hour ago | parent [-]

The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything.

My point was not about getting critical mass, it's that the service can already do anything they like to lock people into whatever they want and gatekeep their service. They can do it with Passkeys, or they can do it with a proprietary alternative and if they're big enough, they'll get away with it. Neither of us can sway them at all - I wasn't saying they should do this, only that they can.

Blaming Passkeys is aiming at the wrong target. Passkeys rightly offer features that have valid use-cases, even the attestation in the right context. Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not.

	▲	devsda 10 minutes ago \| parent [-]
		> Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not. Let the usecases that need passkeys use it. Why can't there be a parallel standard with similar features that doesn't have the parts that can potentially be abused. If the difference between abuse and non-abuse is a vague promise and the good graces of corporate structures, it is better to err on the side of caution and demand solutions that make it impossible. > The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything. Yeah it wasn't your place or anyone else's. How can you or I force anyone. Not sure why that even came up. Debate is how we evolve new and alternate solutions. Handwaving by saying not your place or mine is not how we affect change if needed.