This blog post is the perfect example of someone rationalizing away the bigger picture.

It's true that passkeys do not require hardware and OS attestation today, so all of the specific examples you cite are true. But the point remains that that passkeys can be EASILY extended to require hardware and OS attestation, and this will happen.

Banks have already done this. Before using an app was optional. Play protect was optional. It's like my uncle ted used to say, techonolgy is not optional.

▲

SoftTalker 2 hours ago | parent | next [-]

When my state introduced seatbelt laws they assured the public that they would only be a secondary offense, never the primary basis for getting pulled over and issued a ticket.

Now they run "Officers are watching! Click it or ticket!" as an advertising campaign.

And I'm not arguing that seatbelt laws are bad per se, just that any time there is a pathway for more control, it will eventually be taken, even if assurances are made that it will not happen.

	▲	helpfulfrond 28 minutes ago \| parent \| next [-]
		The arguments of they never "usually" do this, or "the guidance says" are meaningless. Whatever can be used for control, will be.
	▲	jollyllama 28 minutes ago \| parent \| prev [-]
		And every time you point it out, some useful idiot will say "you're making the slippery slope fallacy."

▲

codexb 2 hours ago | parent | prev | next [-]

I think it's more that attestation can require a specific "approved" authenticator, and that authenticator is what would enforce all of the required OS/Software/Hardware requirements, even if it didn't get included in the attestation standard.

▲

tantalor 2 hours ago | parent | prev | next [-]

That's a good thing?

Most consumer websites won't use attestation.

Places where additional security is required (bank, employer, etc) can.

▲

zaptheimpaler 17 minutes ago | parent | next [-]

Access is a good thing too. I don’t want hardware attestation, i want to be able to access my bank from anywhere. Banks continually push their liability for security onto customers.

▲

dpkirchner an hour ago | parent | prev | next [-]

Most consumer websites won't demand you share a scan of your face to third parties, until they do. Same exact thing will happen with passkeys, guaranteed.

▲

Capricorn2481 an hour ago | parent | prev [-]

People who are more tech libertarian don't like when critical aspects of their life requires a smart phone from either Apple or Google. The ability to avoid these companies is becoming increasingly difficult, and attestation is one piece of that puzzle.

I don't think that means throwing out passkeys entirely, but that's why you're seeing a lot of "slippery slope" stuff in here

	▲	tantalor 13 minutes ago \| parent [-]
		Well those people can buy a YubiKey for $30 I guess. I don't see why that's a big issue.

▲

MisterMunchkin 2 hours ago | parent | prev [-]

And passwords could easily be extended to requiring photo ID...

▲

unrented7977 2 hours ago | parent | next [-]

No, they can't. You could try ro replace passwords on your service with some stupid id verification scheme, but you have not extended passwords.

▲

recursive 2 hours ago | parent | prev | next [-]

This is not true.

▲

NoidFonsense 2 hours ago | parent | prev [-]

How? It wouldn't be easy at all it would be totally unconventional and break all sorts of expected workflows for passwords if you had to take a photo every time. For example at my work we have a ton of computers and none of them have webcams.

Passwords are client-neutral. Passkeys aren't: you can force a certain client, and now those clients can force an OS through attestation.

It happens now with 2fa today. I have gone through college for 4 years having to use this shitty duo mobile app and we have to take out our smartphones 20 times a day to do things and re-login after every 20 minutes.

▲

phoghed 2 hours ago | parent [-]

and your bank can't force a certain client for a password if they decide to? or that you need to drink a confirmation can? or whatever arbitrary technical constraints they want to do in general?

anything can happen. if your passkey stops working because you're using it from your smart fridge to access your banking app, then just use your password anyway.

	▲	NoidFonsense 2 hours ago \| parent [-]
		They effectively can't to the extent that it's not a social norm to enforce that level of security theater. You are arguing in favor of normalizing an increased degree of security theater. My point here is that this specific step on the slippery slope is a cliff, not some infintessimal change, because now the authentication is done through a program and not copyable information. If verification-can technology is standardized on an OS level and advocated by four out of five tech priests (and maybe even enshrined in law (think of the children)), then you are going to be drinking a whole lot more mountain dew in the future to say the least. If it was just a single bank or something that tried this, people would get pissed off, leave, and the frog would not be boiled. It takes a slow industry-wide movement to shift the standards of what is acceptible to the common man.