Hacker News Reader

Comment by __MatrixMan__ | Hacker News Reader

Just like there are diehards still running their own email servers (kudos to them), will there be people running their own passkey backends?

If so, I'm open minded. If it's a situation where you have to be in some kind if in-group to do that, then I'm preparing to be as much of a Luddite as I need to in order to avoid them.

View on HN

The specification is open, so anyone can create their own implementation.

However, the implementation also supports attestation, which means a website is able to only allow certain "trusted" passkey implementations.

So, no— self-hosted won’t realistically be an option because “security”.

I should just give up and live in a shack in the woods. The entire industry is hell-bent on subjugating me to one of the big-tech fiefdoms.

Attestation for hardware-backed FIDO authenticators is worthwhile. You can attest to various properties, such as whether or not the credential is protected by a PIN.

Of course it has value, but it’s a tradeoff for freedom.

I don’t want that “security”, personally. I would love to not do business with anyone who requires that of me. Unfortunately, I think that will increasingly force disconnection from society.

It's presumably the authorized party who has the most to lose if the passkey backend is compromised, so it seems weird that the who-to-trust-for-auth decision falls to the web service.

I'm reminded of a sign in front of my neighbor's driveway: "Ford parking only"

Reply on news.ycombinator.com