Hacker News Reader

Comment by hooverd | Hacker News Reader

I think Passkeys are a great idea utterly ruined by vendors licking their chops over locking users in and creeping remote attestation.

View on HN

How am I “locked in” when I can use a different passkey manager whenever I want, just like I can use a different password manager whenever I want?

How does a passkey differ from a password from an attestation POV?

Well, currently, you can export your passwords between your new password managers. You may be able to do that with passkeys.

Also, passwords don't have rejecting [optionally, for now] non FIDO certified devices as a part of the spec. You'll have to use a Trusted(tm) passkey manager.

Fair enough — I've never done a bulk dump of my usernames/passwords, but I can understand how that's a problem for who do (until there's a common passkey interchange format, at least). One aspect of passkeys that may offset the impact of this is the ability to have multiple passkeys for an account, which isn't possible with passwords.

> Also, passwords don't have rejecting [optionally, for now] non FIDO certified devices as a part of the spec. You'll have to use a Trusted(tm) passkey manager.

Sorry, I may not be parsing this correctly: Are you saying that security requirements for pass[word|key] managers is bad? Or are you saying that they're bad because it means open-source solutions can't support passkeys, as @Ridj48dhsnsh suggests?

AIUI the concern is that you will only be able to use Passkeys that are held on devices that have been blessed. You will never get your custom solution blessed, so your access to your bank and government services will become dependent on being in good standing with Google. If your Google account gets deleted or your phone gets remotely deprovisioned, you will be unable to authenticate, and any attempt to create a "backup" against this situation that is fully under your control will be blocked by the attestation requirements.

Quoting from the article's update:

> I got a Nitrokey3 to use as a hardware token, and ended up not being able to access my country's e-gov facilities, because L1 certification required.

What will likely happen is that many services will only accept passkey managers that have been blessed by big tech and locked down to the user. You're not going to be able to authenticate with your bank using an open source implementation.

Level 1 (I think they're talking FIDO?) is the bare minimum level. If Nitrokey aren't certified, there's plenty of open and proprietary keys not owned by "big tech" that are.

https://fidoalliance.org/certification/authenticator-certifi...

Reply on news.ycombinator.com