undefined | Better HN

0 pointsgrowse10mo ago0 comments

> very obviously once Passkeys are everywhere it'll become "we're requiring attestation from approved device bootloaders/enclaves"

This is far from very obvious, especially given that Apple have gone out of their way to not provide attestation data for keychain passkeys. Any service requiring attestation for passkeys will effectively lock out every iPhone user - not going to happen.

0 comments

3 comments · 1 top-level

ori_b10mo ago· 2 in thread

If there's no intention of doing this, it should be removed from the protocol. "I promise we'll never use this feature, so long as you implement it" isn't very convincing.

growseOP10mo ago

Not all people who want to replace passwords are running services available to the general public.

There are a bunch of service provider contexts where credential storage attestation is a really useful (and sometimes legally required!) feature.

ori_b10mo ago

Great, they can use standards that aren't targeted at running services for the general public. It seems like the requirements already diverged.

Drop attestation from passkeys, and I become a promoter. Keep it, and I suggest people stay away.

If it's not something anyone intends to use on public services, this should be uncontroversial. Dropping attestation simplifies implementation, and makes adoption easier as a result.

1 more reply

j / k navigate · click thread line to collapse