I think the reason passkeys are so controversial is that tech has a long history of ignoring user choice and pushing the most anti ownership solutions possible. Therefore, I think there is fair concern emerging along with any new mechanism that has any sort of TPM or hardware attestation components at all.
The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.
The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
Didn’t you already answer this by saying they want to increase adoption? That seems like the reason. I think the argument here is the same as what they do with something like streaming (which is closer to what I have a problem with, rather than locking people to specific software). They work on adoption until the numbers and ease of use are high enough to kill the other options and prevent multiple people from logging into one account. They lose some people, but gain more because of the new restrictions forcing people to have their own account.
Doesn’t necessarily work the same in that sense, but it’s still a numbers game. We continuously see companies/governments postpone onerous policies until they have enough people willing to put up with it. Then they ram it through and ignore the people that complain. It’s age gating and digital only purchases and digital id and backdoors and everything else we see with tech.
Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…
So it suddenly does not provide additional security anymore above what a password manager would already do.
When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…
Or “Like all questions of security vs convenience, a user should decide what they are or are not comfortable with.”
I think the reason passkeys are so controversial is that tech has a long history of ignoring user choice and pushing the most anti ownership solutions possible. Therefore, I think there is fair concern emerging along with any new mechanism that has any sort of TPM or hardware attestation components at all.
The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.
The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
Didn’t you already answer this by saying they want to increase adoption? That seems like the reason. I think the argument here is the same as what they do with something like streaming (which is closer to what I have a problem with, rather than locking people to specific software). They work on adoption until the numbers and ease of use are high enough to kill the other options and prevent multiple people from logging into one account. They lose some people, but gain more because of the new restrictions forcing people to have their own account.
Doesn’t necessarily work the same in that sense, but it’s still a numbers game. We continuously see companies/governments postpone onerous policies until they have enough people willing to put up with it. Then they ram it through and ignore the people that complain. It’s age gating and digital only purchases and digital id and backdoors and everything else we see with tech.
Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…
So it suddenly does not provide additional security anymore above what a password manager would already do.
When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…