See I bought a couple of yubikeys, but have zero passkeys becuase I’ve yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn’t risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login).
I’d happily use passkeys with yubikey, but I’m not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are ‘authorised’ and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.
If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it’s up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.
Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can’t use something like the ‘Solokey hacker’. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.
I have amazon passkeys on my security keys. I didn’t notice anything unusual with the registration process.
All the sites I’ve encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn’t work so far is l1t forum. I don’t know why. but I doubt they require an attested device.
I use a NFC key for my phone.
I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.
See I bought a couple of yubikeys, but have zero passkeys becuase I’ve yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn’t risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login). I’d happily use passkeys with yubikey, but I’m not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are ‘authorised’ and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.
If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it’s up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.
Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can’t use something like the ‘Solokey hacker’. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.
I have amazon passkeys on my security keys. I didn’t notice anything unusual with the registration process.
All the sites I’ve encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn’t work so far is l1t forum. I don’t know why. but I doubt they require an attested device.
I use a NFC key for my phone.
I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.
If you wanna try it out; use https://webauthn.io/