Post #4002288
2026-07-22 02:52 UTC
Replies (1)
-
@ori@hj.9fs.net 2026-07-22 03:01
It's public key cryptography, not a simple password. The private data is not sent over the wire, so it can't be stolem. I would like to have public key cryptography in use for authentication, though I have one major and one minor reservation with passkeys. The major reservation is remote attestation: the party that I'm authenticating with should have no idea what device I'm using, as long as it follows protocol. I don't feel comfortable using a protocol with provisions for this; large tech companies have shown that they're not to be trusted, especially where there's an opportunity for lock-in. The minor reservation is the difficulty of backup and recovery. (If the major reservation is resolved, I can run a non-standard passkey agent that backs up the way I want, so this is only an issue if someone has protocol support for constraining the devices I can use) For me, any doors for attestation are a deal breaker. Drop that from the spec, and I would advocate for passkeys without reservations. CC: @filippo@abyssdomain.expert @shaoyu@mastodon.social