This is FUD about passkeys. The core issue they have is with attestations. Well servers already have ways to require attestations that don’t involve passkeys.
Maybe there’s some strong arguments against attestations, but I haven’t seen them. All I’ve seen is people arguing that attestations make it hard to violate sites’ terms of use or to evade bans.
The author argues that passkey attestation would allow
(eventually, via silent ratchet) any website to make demands about the software you run on your hardware. That would be a new thing and a reduction in freedom and privacy.
This is FUD about passkeys. The core issue they have is with attestations. Well servers already have ways to require attestations that don’t involve passkeys.
Maybe there’s some strong arguments against attestations, but I haven’t seen them. All I’ve seen is people arguing that attestations make it hard to violate sites’ terms of use or to evade bans.
The author argues that passkey attestation would allow (eventually, via silent ratchet) any website to make demands about the software you run on your hardware. That would be a new thing and a reduction in freedom and privacy.