Hacker News Reader

The specification is open, so anyone can create their own implementation.

However, the implementation also supports attestation, which means a website is able to only allow certain "trusted" passkey implementations.

View on HN

So, no— self-hosted won’t realistically be an option because “security”.

I should just give up and live in a shack in the woods. The entire industry is hell-bent on subjugating me to one of the big-tech fiefdoms.

Attestation for hardware-backed FIDO authenticators is worthwhile. You can attest to various properties, such as whether or not the credential is protected by a PIN.

Of course it has value, but it’s a tradeoff for freedom.

I don’t want that “security”, personally. I would love to not do business with anyone who requires that of me. Unfortunately, I think that will increasingly force disconnection from society.

It's presumably the authorized party who has the most to lose if the passkey backend is compromised, so it seems weird that the who-to-trust-for-auth decision falls to the web service.

I'm reminded of a sign in front of my neighbor's driveway: "Ford parking only"

Reply on news.ycombinator.com