Hacker News Reader

Comment by EA-3167 | Hacker News Reader

For a lot of people Apple is the ecosystem they access everything through, including payment processing. That cuts both ways, but Apple has shown a clear preference for protecting user privacy when they could have chosen to do otherwise, presumably because it makes them more money in the long run.

Why would that suddenly change in Netflix or some other company's favor at Apple's direct expense?

View on HN

It's not in Apples expense, it's actually in it's benefit, your keys would be in their system, and impossible for anyone (including you) to get them out of it.

So you are now locked in to the apple ecosystem forever. You now need Apple to watch Netflix from your Samsung TV.

Apple has very good support for Passkey storage in third party password managers/wallets. They don't seem to want Passkeys to be a lock in. They've also made it clear that they see attestation as a consumer privacy violation and won't support it.

> They've also made it clear that they see attestation as a consumer privacy violation and won't support it.

I'm trying to get a source on this but failing, do you have a link or some wwwdc sessions where Apple detail their stance ?

This is some of my notes from the last time this came up: https://news.ycombinator.com/item?id=43988852

Thanks a lot !

I see your angle, but would take their comments more at face value: their concern is really sync, anything privacy probably being the nice side effect.

Sync has been part of their strategy for a while now, from revamping the whole iMessage stack to allow for sync, to their work on eSim etc. so the move doesn't break with their recent trends either.

It seems a case of both. It's easier to find more written documentation than spoken documentation. Unfortunately I have no idea how to search WWDC talks or the like, because they have brought up privacy concerns many times.

That comment reminded me too that Apple had briefly talked about supporting consumer attestation if they thought they could make it private enough and the compromise they ended up supporting and delivering were the uvi and uvm extensions, which is nothing like Attestation, are not attested claims (and can be "lied" about by passkeys), but are a much more privacy preserving alternative. Since uvi and uvm were accepted as standards I've not heard of Apple mentioning consumer attestation again.

(uvi and uvm are the CYA assertions that "this key was involved in a multi-factor process such as biometric unlock" which RPs like banks can use for "due diligence" and "regulatory compliance" to require keys be MFA in some way without requiring a full Attestation. Because they aren't attested they are "I solemnly swear a biometric unlock was used" claims, but in terms of regulatory compliance that should be enough in most jurisdictions especially if you can prosecute liars as in-breach-of-contract or felony misdemeanors, which a bank can in cases of banking fraud. So these extensions are huge and another big reason this article is wrong about the slippery slope here, because Apple already made huge progress in standing up bulwarks against it, uvi and uvm extensions being big bulwarks against attestation requirements for consumers.)

You make it sound like Apple needs to lock the door instead of just opening it while everyone else shoots themselves in the foot. For people who want "it just works" as the highest function of their device, nothing comes close to Apple. It's only people with a technical inclination or specific needs who chaff at that, or people like me who are just cranky old bastards who don't want their own media collection apart from i/Apple/Everything.

But man... I cannot tell you how many people don't even notice the walls of the garden. Besides Apple is in competition with some huge players, more than capable of offering "Done with Apple literally trapping you? Follow this link and we'll transfer your passkeys."

> "it just works"

That ship has sailed a long time ago.

Most people still hanging to that part have already built a whole way of life around the Apple ecosystem and the boundaries and how to work around them have become second nature to them.

The iPhone is now near 20y old, the world also changed, most got enshitificated, and looking at kids and elderlies dealing with their iPhones and macs none of it "just works".

Looking at Japan, it was the bastion of iPhone predominance, but I'm the latest numbers 30+ yo gradually got off the train to move to android as their phone is just becoming another tool to them.

You said “it doesn’t” a whole lot, but unless I missed something you didn’t give any examples of what’s failing. From my own experience integration of peripherals is seamless within the ecosystem, and my elderly relatives never need tech support.

I’m sorry you’ve had a bad time though.

From the top of my head, try to share your Fitness data to someone on a regular basis. We bought our mother in law an Apple Watch and she asked us to remotely check her data from time to time. We gave up pretty fast.

I'm on Android and my kid got my old iPhone. Parental controls can't be set by me.

My Apple ID still tried to contact my old iPhone when logging in as a dev.

I don't need to expand on iMessage and where messages go, it's part of the lore at this point. My wife's airport auto-swirching was also a mess to the point she disabled it.

Google Maps' time line features get randomly shut off and you only know it way after the fact.

The list just goes on and on. I also have my frustrations on other platforms, I'm just pointing out Apple is far from being great. People just get used to the rough edges after a while and tout it as "good enough".

> Done with Apple literally trapping you? Follow this link and we'll transfer your passkeys.

That's the whole point of the FIDO specs. This is now literally impossible to do. All the vendors are weirdly okay with this I believe it's because it cuts both ways.

Except that this is not true. There is a FIDO specification for both a format and secure protocol for exchanging passwords and passkey information between password managers, with support on all Apple platforms, and implemented by 1Password, Bitwarden, Dashlane, and more:

https://rmondello.com/2026/09/07/switching-password-managers...

https://fidoalliance.org/download-credential-exchange-specif...

Oh, that's good. They've moved on from threatening password managers of their ability to be considered a trusted app if they offer that functionality, like they did to KeePass. "We'd hate to have to blacklist KeePass".

> for both a format and secure protocol

No, there is a working draft of a protocol. The "format" is only for use in the protocol, not a separate thing. Thus, giving the user a file is disallowed under the spec as per §5.1.1.1 which reads

  > Explicitly state that the orchestrating party only transmits the credential exchange data between the exporting provider and importing provider.

And, in accordance with the spec, 1Password refuses to export passkeys directly to users for manual import on another platform or app. FIDO developers have complained about Keepassxc violating the spec and threatened to blacklist them as a result[1].

Furthermore, 1Password (who is apparently leading the way on the FIDO exchange protocol design) has not implemented _any_ passkey export on _any_ desktop platform.

It is interesting that you listed Bitwarden, since I believe that FIDO developers have specifically disavowed Bitwarden's behavior of allowing users to access their passkeys.

[1] https://github.com/keepassxreboot/keepassxc/issues/10407

[2] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Both Android and iOS support 3rd party password managers as the passkey store. Bitwarden with passkeys works seamlessly on both my iOS and Android devices (along with MacOS, Windows, and ChromeOS).

If passkeys are intended for platform lock-in then Big Tech is doing a really bad job...

Reply on news.ycombinator.com