This is another way they’ll lock out Linux as an OS. It won’t pass passkey attestation or age check attestation so it just won’t be allowed to access the web because clearly you’re a bot or some other bad actor for failing those.
That or they’ll create a special government backdoored and approved Linux that has attestation in among a bunch of other blackbox modules that you have to trust aren’t an NSAKEY right into your system.
The future looks so bleak with all this online, Flock, Axon, etc cameras IRL controlling all movement and all fed into Palantir for one online and offline profile of you for the police state.
There is a subtlety here that I feel like is being missed. Yes, via remote attestation, websites can require only passkeys from Google and Apple are usable. But you can still use those passkeys with Linux. It is a restriction on how you can authenticate and I can understand concerns over the lack of freedom in this area, but it is pretty far from a threat that would prevent the use of Linux.
you do not have ultimate control over your passkeys.
Looks like it boils down to that? Because I just started using a few and they’re on my self hosted vaultwarden so…
Passkeys give me anxiety because it’s like “Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO”
Use a password manager like bitwarden et al.
Basically the problem is that Passkeys are designed to allow a particularly bad enshittification once everyone uses them. So it’s not about downsides of using them now, but about them being used in general and then abused.
I like the article and agree with the problem, but I’m skeptical that this works as a strategy to fix the problem. First off, individual responsibility or boycott doesn’t really work. Most people will just use what their phone gives. Second if the corporations do want to do this, they could implement it separately in their apps, like twitter or google chrome requiring quasi-attested “homebrew” passkeys stored in cryptoprocessors. Ultimately I do not think we have any power to prevent them from doing that.
The time of democracy and pluralism is over. We’re already seeing the author of the article being maligned and personally attacked for talking about AI - how dares he? On all fronts we have lost the culture war and lost power, economic power, information power like access to truth.
Yeah, but if the big company wants to embed weird shit in their client software… A frontier model can reverse engineer the client, determine what satisfied the authentication request, and replicate the implementation elsewhere on our own terms. Can do this with less than $100 worth of compute. I know because I’m already compiling/sideloading iOS apps with Xcode on my Gentoo desktop — Apple can eat shit.
Then this turns into yet another arms race of fixing and breaking.
Hiding stuff in client side software never stopped being an arms race between the producer and consumer. LG TVs are a great example.
Healthequity tried forcing this passkey garbage on me, and they wouldn’t allow me to manage investments over the phone, so I ended up transferring everything to a different HSA provider. Not giving in. I love TOTP though.
Based
So it’s HDMI for login? Thanks, I hate it.
An attempt to make an image describing where passkeys live:
It’s funny because I can’t see it and when I view the code of your post and copy/paste it into the location bar I get the broken jpeg picture.
Edit: At the time of upload it was a png. I guess lemmy.zip made the choice to convert it.
It’s even more apropos that the fediverse behaves unpredictably when uploading images.
Passkeys in a nutshell: how does it work? Idk. Who’s in control of it? Idk.
I wasn’t able to see the image because it’s an avif. What a weird format and choice of format.
Apropos of a discussion about over complicated unpredictable passkey behavior.
As far as I know using a password manager such as KeePassXC or Bitwarden solves all of these problems?
The way i understand it is that remote attestation (main point of this article) makes it possible for services to deny unapproved software. They can deny off market devices, operating systems, or certain password managers. So even if you use password managers you mentioned, if you’re using off market OS (e.x lineageos) they can deny access. Here’s a quote from the article “Remote attestation lets a website demand cryptographic proof that your device, operating system, firmware, and passkey manager are all on an approved list.”
Hm, so similar to websites blocking user agents now.
It’s more like how my bank has started locking users out of online banking if they don’t have the mobile app for authentication, and preventing the mobile app authenticating the user if they’re running a non-approved version of Android like GrapheneOS. Try to gain digital independence and all these mechanisms will be used to shut you out of everything you need. Only thoroughly locked-down and surveiled devices will be allowed to access useful services.
and your redundant 3-2-1 backup system of that. Everyone knows that! Surely no one has no backups. Oh well, can’t design around that unpredictable problem that no one could guess. Everyone has backups!
I mean I would hope so, but losing a password manager database sucks regardless if you used passkeys or not.
Make that question mark a period, good sir/ma’am!
Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.
The problem isn’t you or me, the more technically aware… it’s when the majority of users switched to passkeys and then subtly get switched to attested passkeys and sites don’t offer other choices. Once the majority are under-thumb, sites won’t have a reason to offer open solutions to the same number of objectors.
And for the bank, you can always switch to a better bank.
Corporations want what they’re terming phishing-resistant passkeys, which have two approaches: hardware-based or synchronized passkeys. If they are forced upon us for certain services or jobs, the least harmful to a worker is a synchronized passkey. Password managers like Bitwarden support this, so that you don’t have vendors and employers tracking your cell phone. If an employer uses something like Microsoft, the administrator settings may not allow synchronized passkeys…but at least we can advocate for them when these auth methods are forced upon us.
dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?
That seems to miss the main point of the article, which is that Passkey standard has attestation procedure built in. A site that uses Passkey can verify the flags you set and deny your access if you use unapproved device, operating system, old kind of secure chip or, say, allow your passkey to be shared between devices.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.9 This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.
Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check. After all, your phone’s operating system has total access to all the 0s and 1s in every app that’s ever run, so it’s not enough for Twitter (formally X) to trust your passkey manager if it can’t even trust your phone’s underlying operating system. If any single one of those things were to fail – say, because your phone stopped receiving security updates so you installed a custom operating system like LineageOS to keep yourself safe without having to buy a new device – then Twitter (formally X) will be able to notice and prevent you from logging in.
Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)
The convenience of using passkeys is a double-edged sword.
This is also one of the ways Playstation stops you from installing Linux and other unauthorised software on the PS5.
Yeah the technology is cool but I stay away from passkeys and tell people not to use them because there’s too much room to permanently screw up.
Maybe they’ll remove the non portable type from the spec or roll it into an enterprise equivalent like with ad.
Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn’t Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).
But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator…
We’ve been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for “security”?
It seems perfectly in line, and I think this article draws all the right parallels.
Pepperidge Farm Remembers when the FIDO Alliance threatened to recommend the blocking of FOSS implemententions because they gave the users control. Control over backing up. Control over not using biometrics.
When something wants too much power, you must avoid.
FIDO 2 level 2 also requires the supply chain documented and a bunch of expensive certificates, which locks small vendors and open hardware implememtations out.
