zlacker

[return to "A Tour of WebAuthn"]
1. lapcat+Vr[view] [source] 2024-12-26 23:00:42
>>caust1+(OP)
> A passkey is a synced, discoverable WebAuthn credential.

This is my fundamental problem with passkeys: I don't want to use any syncing service.

To be clear, I don't want to deprive other people of the ability to sync their credentials; I simply want to opt out myself. I just want to be able to manually back up and restore my credentials, like I've always done with passwords, but the passkey vendors seem to want to refuse to give anyone this ability. The vendors claim that this is to make phishing impossible, but I abhor paternalism in all forms, and also it's suspicious that this paternalism forces people to use the syncing systems of the passkey vendors, which are usually paid subscriptions. So passkeys become an endless supply of money for the vendors.

It's very telling that passkeys were designed and shipped without any export/import mechanism. You can plainly see the priority of the passkey vendors, which is to lock you in. Allegedly, export/import is coming sometime in the future, but I strongly suspect that they'll end up with some kind of "approved provider" system so that the big passkey vendors can retain absolute control and avoid giving power to the users.

◧◩
2. no_wiz+Pr1[view] [source] 2024-12-27 14:38:15
>>lapcat+Vr
At some point, you have to trust something. Thats how I feel about WebAuthN and syncing services.

Ideally, some of this could actually be solved by having a government organization that provides this and is regularly updated / audited etc. but in the US at least, we are not in any place for that to happen, so you need to pick a provider.

Apple is reasonably good at this, if you're in their ecosystem. Can't speak for Google. 1Password has been very good to me as well, and there are Yubikeys too.

Nothing is perfect, but this is a far, far far better state than were it was heading before WebAuthN

◧◩◪
3. lapcat+zw1[view] [source] 2024-12-27 15:09:32
>>no_wiz+Pr1
> At some point, you have to trust something.

If by "something" you mean an internet syncing service, then no, I don't.

I do trust my own backup methodology.

◧◩◪◨
4. no_wiz+4n2[view] [source] 2024-12-27 20:51:43
>>lapcat+zw1
Some service. I’m not saying you have to trust what I trust.

Personally I’m a big 1Password fan and have been in the Apple ecosystem for a very long time as well.

Most security folks I trust also vouch for them, as far as practices and effectiveness goes of their software.

But you’ll need to trust something somewhere, and you might even need to expose it to a network in some cases.

The one thing I really like about Yubikey is it doesn’t require a network connection at all to work, but it never caught on generally for that model to be widespread supported so I have found while I do use my Yubikey a fair amount there are still things that don’t accept it that I wish did

◧◩◪◨⬒
5. lapcat+Bv2[view] [source] 2024-12-27 21:58:22
>>no_wiz+4n2
> But you’ll need to trust something somewhere, and you might even need to expose it to a network in some cases.

Again, no, I don't, and you still haven't explained why. Unless you mean that the big tech companies will force me to use a sync service whether I want it or not.

Moreover, you've ignored my point about paid subscriptions.

[go to top]