Post #4002287

It's public key cryptography, not a simple password. The private data is not sent over the wire, so it can't be stolem. I would like to have public key cryptography in use for authentication, though I have one major and one minor reservation with passkeys. The major reservation is remote attestation: the party that I'm authenticating with should have no idea what device I'm using, as long as it follows protocol. I don't feel comfortable using a protocol with provisions for this; large tech companies have shown that they're not to be trusted, especially where there's an opportunity for lock-in. The minor reservation is the difficulty of backup and recovery. (If the major reservation is resolved, I can run a non-standard passkey agent that backs up the way I want, so this is only an issue if someone has protocol support for constraining the devices I can use) For me, any doors for attestation are a deal breaker. Drop that from the spec, and I would advocate for passkeys without reservations. CC: @filippo@abyssdomain.expert @shaoyu@mastodon.social